At work we have an onsite Zulip instance which meets both those requirements for us (including SSO integration). It's surprising to me that there aren't more places using it.