I would assume that the URL is picked up by whatever "thing" is generating the action item.
So if your AI is generated by a APP service, then it will pick up the URL as defined in the NSA covering that APP service (i.e. SSO with pick up the SSO URL, non-SSO will pick up the non-SSO URL, assuming your setup is defined correctly in the NSA).
For AIs generated by a process, then it will depend upon which BG service has created the AI - if the BG is only running on the (eg) SSO setup, then I would assume you will only get SSO links in your AIs.
--
Not sure that there is going to be a simple solution for you then, as I don't think you can easily control which BG a process will run upon?