I'm going to try my best to explain this.
I have a shared device group Panorama > Device Groups (photo) called "common"
It has no Master Device or Devices/Virtual System attached (highlighted last two columns).
We use this to create Rules on to push to the various systems listed underneath (Enterprise, 01-Enterprise and so on)
When creating those Rules on Panorama Policies tab > Post Rules > and I choose the Device Group "Commom" > Add (new rule) > User tab > Add a list of groups is available from the drop down (photo).
My issue is that I don't know where Source User is being populated from. I get how it happens when devices are assigned, but since there is no device assigned, I can't go to from Panorama Device > User ID > Template (drop down) choose "Commom" because Shared Templates aren't in the drop down > Group Mapping Settings > Add
But it's clearly getting populated somehow???
Hope that makes sense.