SAML IDP-initiated without webtop

That's what I'm saying. Your IdP visual policy could look like this:

start -> [auth] -> allow

Apply the SAML IdP config as an SSO profile to that access policy (directly) - no webtop, no resource assignment. You just need to make sure that at some point in the visual policy you populate that Assertion Subject Value session variable.