OK, I finally worked on this AGAIN and remembered how messed up this is conceptually.
username: groupname@domain
password: (any one of the passwords of the people that have access)
This is also makes Freescout work for me https://forum.cloudron.io/topic/12976/connection-could-not-be-established-with-host-mail-domain-com-connection-timed-out-110/43
A single "username" having multiple passwords is what messes me up every time.