Domain Users + Local Groups + Scale Out Deployment = Problem

We have a problem authenticating domain users contained in local machine user groups across multiple web servers in a scale out deployment.

When we originally setup our single SSRS database server we were told the a best practice is to add domain users to local user groups on the SSRS machine.

Now we want to add more web servers and create a scale-out deployment. So, we added the web servers and configured the scale-out deployment. But, only administrators can see the reports since all of our SSRS roles are assigned permissions such as "Machine1User_Group".

We were told that we have to create identical local groups on Machine2 and Machine3 and then add them to the SSRS roles. This is prohibitive since it would mean managing 3 identical user groups containing thousands of domain users.

Is there a better way to do this without using Domain User Groups?

Thank you for any assistance.