CiviMail not showing proper groups for multisite

Because groups are not tied to a domain, they are accessible to anyone. This means 1) they see groups that are irrelevant to them and 2) in CiviMail send mailings out to records who are not within their ACL control via this extension: https://civicrm.org/extensions/multisite-permissioning.

This leads to the question, how do we get more entities to be domain specific? There are some listed on the old documentation as desirable here: https://wiki.civicrm.org/confluence/display/CRMDOC/Multisites%2C+Multidomain%2C+and+Multilevel+ACLs#Multisites,Multidomain,andMultilevelACLs-FunctionalSeparationinMultisite, groups is not.