SAML SP post binding to IdP

So in my APM policy I would remove the login page and make the SAML auth the first item in my policy then?

Yes. The SP will send the client a physical redirect (via 302 or auto-posted form) to the IdP for authentication. You could potentially subvert that redirect and force the client back to an APM VIP, and then POST those credentials to a remote IdP, but it would not be a trivial configuration.