User1 can use self-service password reset (SSPR) to reset his password: Yes. If User1 connects to Microsoft Exchange Online, an on-premises domain controller provides authentication: Yes. You can add User2 to Group1 as a member: No.

User1 ' s account lives in OU1, which is included in the Microsoft Entra Connect sync scope, so User1 has a corresponding, synced object in the tenant; with password writeback enabled and no other blocking configuration indicated, a synced user like User1 can use self-service password reset, and the reset password is written back to on-premises AD DS as well. Because password hash synchronization is explicitly disabled and pass-through authentication is enabled instead, cloud sign-in for synced users is validated by the pass-through authentication agent relaying the credential check to an on-premises domain controller in real time, rather than against a cloud-stored hash; so when User1 signs in to a cloud service such as Exchange Online, authentication is indeed provided by an on-premises domain controller through the PTA agent. User2, however, belongs to OU2, which was not selected in the Domain/OU filtering configuration, so User2 has no corresponding object synced into the tenant at all. Group1 is a group in the tenant (a cloud-side security group), and because User2 has no synced cloud identity to reference, User2 cannot be added as a member of Group1 — there is simply no cloud object representing User2 to add.