Hi we are seeing the same issue. When I look at the syntax available it appears to support only user mapping and not security groups. Also found the following:
cluster1::> vserver cifs create -vserver vs0 -cifs-server vs0cifs
-domain companyname.example.com
cluster1::> security login domain-tunnel create -vserver vs0
cluster1::> security login create -vserver cluster1 -username
DOMAIN1\Administrator -application ssh -authmethod domain
https://library.netapp.com/ecmdocs/ECMP1196798/html/GUID-BC7B1934-DDE6-4AFB-A319-6C85D1ADACB6.html
Fingers crossed that security groups are added in the future so it work like 7-mode
Regards,
DominicK