I think this is the bug.
When you were updating emails via SSO cause you have sso_overrides_email enabled the auto group membership was not taking.
It would take for initial user creations.
Note, there is the whole “retroactive” concept that is massively confusing, we should probably just remove that. I recommend you make sure Apply the same email domain rule to add existing registered users is always set, we are going to be removing it.
https://github.com/discourse/discourse/commit/b824898f614d21c43a78fec30481757341106d5a