Yes, this is part  of "security"
1) SPS tries to validate the user: a) the user must be in the same domain
as the portal server or b) in a domain  with a direct trust relationship (no
transitive trusts).

2) You should check your IIS on the portal server to make sure the
authentication method is the same as the domain you are trying to add  users
from.

3) I also have not been able to add users  with just their email id (as the
'add user' function states/implies you can) because I did not set up "Active
Directory account mode"

4) Definitely see: "About domain and Active Directory account modes" in the
SPS "User's Help.chm"

5 Therefore - if you want to grant access to a user - there must be some way
of authenticating the user - you must create an account for the user. -or-
allow 'anonymous' (A BIG security  NO-NO).

I'm no IS professional, so maybe you can help me better understand what
type of security  I have setup.

Up until we started experimenting with SPS, we had just a single Small
Business Server 2000. In order to experiment with SPS, I added  a second
server running Windows 2003. So, I think what I have is SBS2k as a
domain controller and Windows 2003/SPS on a standalone server.

BTW, I've had no trouble adding individual users  from the domain. It's
just groups  that I can't add.