This would have to be done on the Keycloak side. When a user logs into DataHub, we ask Keycloak "Hey, can this person log in?", and Keycloak is responsible for saying "Yes" or "No",
From what Ive heard, though, Keycloak is pretty inflexible w.r.t. doing things like this