Using FBOauth, only allow existing users to associate a Facebook account
It turns out the FBOauth modules checks for the ability to create new accounts. Since we've limited our system only to User 1 and LDAP, no new FB accounts appear to be created. This leaves the user only to log in with an LDAP/AD account and then associate FB and their Drupal account. That is the exact behaviour for our use case!