How to force users to log in with OAuth My site forces users to log in with a specific OAuth provider for some reasons. Users should not be able to log in using their username and password pairs. Only the site managers can have accounts independent of OAuth.

When first creating an account with OAuth, the 'pass' field is set to an empty string ''. My first question is whether it is the right and most secure way to prevent logging in using password.

The second question is about requesting new password via email. I implemented hook_menu_alter to customize user and user/login and to unset user/password. Now users cannot access user/password, I wonder if there is a bypass for it. This question is less important since almost all users would never bother with or even know the possibility of requesting new password.
If you disable email notification of new accounts, the OpenID module will set a random password when users register. See openid_form_user_register_form_alter(). If that is not what you want, you use hook_form_alter() to do the same thing under your desired conditions.
If you want to intercept user_pass_reset() so it cannot reset passwords, try using hook_form_alter() to add a form validation function.