[ATP/FLEX] Does the group name in "External User Group" have to match the group on the AD server?

Zyxel_Emily

No, the group name doesn't have to match the group name on the AD server. In this example, AD_test_group is the group name on the AD server, and the group name on nebula is group1.