Authentication on Kerio for the network, how to implement?

Question

Computer networks

Greetings, Comrades!
Tell me this nuance for Kerio Control, if anyone knows: "How can I implement authentication for the network so that domain users are taken into account, and let's say "guests" (not a guest interface), non-domain users in a separate Vlan.
More details: There are two networks - 2.*/24 and 3.*/24 for example.In the first one there are domain users, and in the second there are mobiles and laptops of guests via WiFi.On access points and on L3 switches, everything is broken, so just packets come to Kerio from two subnets.So
, there are these checkboxes:

If I check the first box, then NTML authentication works and the statistics show the name of the PC and, most importantly, the user who went online. But the problem is that for people from a different subnet, a request for access is displayed every time. If I uncheck the first checkbox, then NTML authentication stops working for me and PCs are simply shown in the statistics without specifying users, which is not correct.
How can I make NTML authentication work for domain users so that another subnet can also go to the Internet normally. Of course, I can log in to the domain user on Kerio and assign him an IP manually, but there are a lot of users and this is not an option, what if the user logs out from another car, etc., and the data will be old? In general, this is not an option.
Why NTML authentication does not work without the first checkmark on the screen, I do not understand. Has anyone encountered similar?
PS The option to move the second network to the "Guest" section is not an option.
PPS As a crutch, right now I did it differently, I turned on both checkboxes, and on a different subnet (not a domain one), I made a separate user, in the properties of which you specify the range of just the same network 3. * / 24. It seems that this option works, but I'm not sure how correct this crutch is. Perhaps there is another solution to this problem?