I think I'm missing something here. Are you saying that Security Roles are being added automatically to the <Global Roles> where they weren't there previously?

If Synchronize is checked in the settings and there's a Role in the <Global Roles> that matches an AD Group that the user belongs to it'll automatically add the user to it. That is by design (why make an administrator do twice the work (add the user to a group in the AD and then have to do it again in the website)?). The "Auto Assign" checkbox is for DNN standard registration and doesn't play a part in the AD provider.

I understand what you're saying but I'm having problems with it happening for the simple reason that when the roles are synchronized it takes loops through the Security Roles in DNN and then checks if the user belongs to the corresponding role the AD. There's nothing in the code that creates a Security Role. What version of the AD provider are you using and version of DNN? Are you using Forms Authentication in your web.config or has it been changed to Windows?