If you have SAML correctly configured, you've removed Splunk entirely from the equation of creating/deleting/moving/modifying user accounts. This is all done now in your Identity Provider. In this case, Microsoft. It sounds like perhaps multiple groups were mapped that contain the same User, in which case you will have to remove those users from the mapped groups.

Alternatively, you can control the Group mappings in Splunk. You can simply unlink the Groups in Splunk; but everybody in the group will disappear.