I finally got it to work using a security group. I ended up making two changes:
I used \\domain\securitygroup (not \\domain.local\secgroup, don't think this part was the part that got it to work)
I then also moved the security group out of its OU and into the default "users" container.
Those two changes and then I was able to let thin print add in the drivers.