Export/Import Users/Groups from AD to Test AD

Thedarkpools 

restoring domain controllers and other critical servers into a segregated environment is normally the best method - as recreating the server / users is not a true representation of the production domain, and would potentially lead to non predictable results - things like SIDs etc will be different and the potential for configuring differences between Prod and Test is greater.

As for requiring access to SSO and Office365 if you are using the same namespace/forest/domain/upn trying to connect to the same tenant you will run into issues regardless of the approach (PowerShell verses cloned/restored). Typically we would have the test domain going into a test tenant...

if forest/domain namespaces are different then you could connect both domains into the same tenant - with AD Connect in Production network connecting to the test network (Two different domains in one Office 365 tenant - Microsoft Tech Community) for more information. But again if your user details UPNs etc are the same you will run into issues and potentially have your production users soft-matched to the test domain user account