In on-premise version (LBD), it is not possible to import users from any trusted Active Directory. In order to enable users coming from others AD than the D365 AD, they must be named manually. AD user groups can't be used neither. So in terms of administration and maintenance, this is becoming a very complex task since role must be applied to users and not user groups.