This looks correct, however for this to work for domain groups you will want to add the lines in such a way that the the allow lines from all of the respective groups are grouped together followed by the files pattern.  I wouldn't use SID since that is used for the default /purl/ exclusion when a site is marked private.