Domain Access and CIVICRM ACL of data and drupal
It sounds like what you want is CiviCRM multi-site capabilities with the multisite extension.  This will give you most of what you want without ACLs, and integrates well with Domain Access.  I've also written an extension to properly handle creating new user logins via CiviCRM profiles with Domain Access.

To handle the "propagate some groups to all users" scenario - with multisite, every subdomain will have a "master group".  Any contact in that group will be visible to all contacts on that subdomain.  If you set a master group as the parent of another group, all those contacts become visible to those domain members.  Since a group can have multiple parents, simply make the "visible to all" contacts have all the master groups as parent groups.