Our workaround is to have users create their own public ArcGIS Online account, which we then invite to our ArcGIS Organization. Our instance is configured to support both Enterprise and ArcGIS credentials. They can then login to CityEngine using their non-enterprise account.
It is frustrating for them, however, as they end up with content spread across two ArcGIS Online identities in our organization. To help alleviate that issue to some degree, we create an Access and Update group for them, of which both their accounts are members. They then can share content to that group, and work with most kinds of content without having to worry about whom they are currently logged in as.
That all generates a lot of manual work for administrators and the end-users, and is not something that scales well and is not easily automated.