Syncing by groups alone is not supported in production however - only for a pilot test
So, sync your on-prem forest and filter out any OUs not needed in the sync and ensure the groups and users in those groups that you DO need are not in any OU you may be filtering out.