SCCM version is 1910. Your GP settings look pretty much the same although we're set up so that our users have to be in a particular AD group. In the HIP profile we specify that the clients must be members of the domain. I'm not seeing any material difference.