Adding ReadOnly Domain-less replica to existing AG with two replicas on two nodes WSFC
Since you got SQL 2017 on Windows Server 2016, you can achieve that (what your looking for) with anyone of following options:


Domain-independent Availability Group
For this to happen, you probably have to re-build WSFC as Active Directory-Detached Cluster since your existing WSFC would expect all nodes to be part of same domain. Consider it's bit complex setup compare to LS and required additional maintenance of master keys and certificates as AG Replica's end-points communication completely depends on those.  
Log-shipping
Configure the log shipping pointing Listener name (existing AG) as Primary server and new node as Secondary server in Log Shipping topology