This article helps to explain the issue when apply-groups configuration is mapped to security policies managed via Security Director On Prem(SDOP).
For Apply-groups-