I tested this a while back, and found that Domain Users does not work for group matching. Since it is used as the basic filter for enrollment, it would be the same as using the Everyone group. Since it is already in use for matching valid/invalid users, it is not able to be used for matching to a group.
If there are multiple domains, this would prevent one from setting up different policies based on domain and matching to Domain Users for each. Other than that, the Everyone group should be used if you wanted a policy for all Domain Users.