This seems to restrain automating group membership to only users who are in the same domain as the group. 

Or am I mistaken -- is there a way to achieve this? 

My work-around consideration would be to manage groups on each domain in separate policies, then make those groups members of the parent group that resides in the target domain. 

Thank you