Removing users from the dynamic domain is meaningless if the dynamic domain is enabled for use. Dynamic users are not authenticated, nor are they prevented from accessing all resources provided by whatever privileges are granted to the dynamic all group.

If you were to remove a user from the TDV list of users registered in the dynamic domain, that would remove any group membership that had been assigned to the user, but the user would still be able to use a client with the same user ID for login.