Implementing Universal Groups

Use Global Group to hold accounts as members. Avoid group nesting to the minimum to avoid confusion
Use Domain Local Groups to provide access to resources in specific domain then make domain local groups members of access control list for specific resources in the domain, such as share folders & printers
Use Universal Groups to provide extensive access to resources, particularly when Active Directory contains trees and forest, or to simplify access when there are multiple domains