Hi @gubbins,
There is an API that will allow a user to change their account to using SSO at /api/v1/users/switch_to_sso but it was not designed for a system admin to take advantage of, as it requires the user's password for authentication and also requires the user to sign-in to their GitLab account for verification.
This is on our radar, however, and I have created a Jira ticket here to track a feature that will allow you to force your users to switch to a certain sign-in method.
As for now, if you were to start with a fresh Mattermost instance you could force all users to sign-up with GitLab and you could disable all other sign-up methods from the System Console. Migrating an existing instance programatically would be a bit of a hassle.