The recommended approach is to follow the Configure federated authentication guide to implement your identity provider.
Sitecore's Owin extensions are actually quite powerful and are designed to add multiple ways to authenticate, on a per site basis, all via configuration.
One thing to note that isn't covered in the documentation there, is that for Sitecore to know that a user is a virtual user, you need to set the following Claim:
<claim name="http://www.sitecore.net/identity/claims/shadowuser" value="true" />