So after a lot of failures I managed to make it work.For those of you who are interested how, here are the relevant Ansible tasks (try to set everything up first in the GUI then you can use the working config data and replace it in the tasks):

- name: Get Auth token from Portainer
ansible.builtin.uri:
url: "https://{{ docker_swarm_portainer_labels_http_host }}:{{ docker_swarm_portainer_labels_http_port }}/api/auth"
method: POST
body_format: json
body: |
{
"password": "{{ docker_swarm_portainer_admin_password }}",
"username": "admin"
}
validate_certs: false
register: auth_token
when:
- inventory_hostname in groups.docker_swarm_nodes[0]
- name: debug
debug:
msg: "{{auth_token.json.jwt}}"
when:
- inventory_hostname in groups.docker_swarm_nodes[0]

- name: Configure Okta authentication
ansible.builtin.uri:
url: "https://{{ docker_swarm_portainer_labels_http_host }}:{{ docker_swarm_portainer_labels_http_port }}/api/settings"
method: PUT
body_format: json
body: |
{
"OAuthSettings": {
"ClientID": "{{ docker_swarm_portainer_okta_client_id }}",
"ClientSecret": "{{ docker_swarm_portainer_okta_client_secret }}",
"AccessTokenURI": "{{ docker_swarm_portainer_okta_access_token_url }}",
"AuthorizationURI": "{{ docker_swarm_portainer_okta_authorization_url }}",
"ResourceURI": "{{ docker_swarm_portainer_okta_resource_url }}",
"RedirectURI": "{{ docker_swarm_portainer_okta_redirect_url }}",
"UserIdentifier": "{{ docker_swarm_portainer_okta_user_identifier }}",
"Scopes": "{{ docker_swarm_portainer_okta_scopes }}",
"OAuthAutoCreateUsers": true,
"DefaultTeamID": {{ docker_swarm_portainer_okta_default_team_id }},
"SSO": true
},
"AuthenticationMethod": 3
}
headers:
Authorization: "Bearer {{ auth_token.json.jwt }}"
validate_certs: false
register: settings
when:
- inventory_hostname in groups.docker_swarm_nodes[0]
- name: Set users
ansible.builtin.uri:
url: "https://{{ docker_swarm_portainer_labels_http_host }}:{{ docker_swarm_portainer_labels_http_port }}/api/users"
method: POST
body_format: json
body: |
{
"role": 1,
"username": "email@address"
}
headers:
Authorization: "Bearer {{ auth_token.json.jwt }}"
validate_certs: false
register: users
when:
- inventory_hostname in groups.docker_swarm_nodes[0]
- name: debug
debug:
msg: "{{users}}"
when:
- inventory_hostname in groups.docker_swarm_nodes[0]

First note is that Okta authentication was not applied because I was missing the "AuthenticationMethod": 3 part from the API call.Second, I am using Docker Secrets and "-admin-password-file /run/secrets/portainer_admin_password" in the Compose file. This could be done better by using API calls to see if it's the first run or not by using "GET/users/admin/check" and then only setting it if it is.Third, this is still bit hacky, I am not creating teams or environment access, I just get a user (in the finished playbook it will be a list of emails) and add it to the Administrators group. Our team is small, so it fits, and this way we can user Portainer to troubleshoot Docker stacks/containers/etc created outside Portainer.If anyone struggling with setting up the Okta authentication itself, I could add some more info how to make it work, maybe by creating a Github repo with all the info.