Do I need Crowd for SSO with Jira+Confluence and external IDP

[Kris]

Hello,

I use an external IDP and would like to realize a SSO with my on-prem jira and confluence server. Should I use Crowd or directly configure jira and confluence with SSO 2.0 SAML?

I would like to manage all my user access policy within the external IDP.

The jira and confluence server are behind a firewall and do not have direct access to internet. 

What is best practice?

[Kris]

additional I found out, that I have only Server licence and NOT Data Center.

Is it possible with or without Crowd (Server) to have SAML SSO behind Firewall to connect to jira and confluence?

Or is the only option upgrade to Data Center Version or get third party tools?