I have linked an example below where someone has documented various workflows on how to remove ALL access from an identity on a leaver lifecycle state change.
In your case, you can take this example and adapt it to only remove entitlements for your SalesForce source