Problem
I don’t want my users to be able to go to Facebook, but I need them to be able to login with it.
Solution
Use the restrict website feature and whitelist the main URLs you plan to use, but don’t whitelist Facebook.
Note: Whitelisting the main domain (mysite.com) will automatically include any subdomains (sales.mysite.com) as well as any paths after the main URL (mysite.com/products/)