You make a good point - the allowed email domains setting is a rather blunt tool. It is intended for locking down a community to a specific domain, for an internal community.
This is not likely to change so you’ll have to find another means to achieve your end - but it sounds like you already have a solution that will work for your community which is to give the people who sign up the access they need.
I think the ability to create invites that allow anyone from a specified domain to sign up immediately and be given the privs they need will be interesting. The link could safely be posted online, on the login page even, because it cannot be used by anyone except authorized people.