Enable single sign-on for subscribers only

I’m not sure whether this is a daft question. I’m setting up a new blog on an issue that always attracts evil-doers. I’ve implemented the usual security measures with tighter rules than normal, but am concerned about the WordPress single sign-on. We want visitors to be able to subscribe easily to posts & newsletters, etc, so single sign-on will be perfect for that.

But I’m anxious about this opening vulnerabilities. A quick search on ‘how to hack WordPress admin’ convinced me that using a global login is the first step.

I’ve added an extra field to the admin login for people accessing our wp-login page. Contributors and higher have a secret password for it. But this obviously doesn’t stop anyone logging in through WordPress.com!

I’d like to be able to force users with privileges to log in through the website. Is there some way to disable single sign-on for them, while allowing it for everyday visitors?