I think I might be confused by your question but I'm going to try to answer it. This is going to handled the same regardless of the AD provider or just the regular DNN provider.

To manage a user you have to be logged into that particular portal. You can't manage a user's Portal A properties while you're visiting Portal B. So to give a user admin/edit rights on Portal A you have to be on Portal A, to give them rights on Portal B you have to be on Portal B. The subscriber's group has nothing to do with locking an account or restricting managing it.

As an example, I just created a child portal off my dev site. Logged into both sites with my AD user, logged off, and logged onto the parent site with the host account. I then went to the Users Accounts and selected Manage Roles for my AD account. I added the account to a role and then I typed in the URL for the child site and did the same to the AD account on there.

I'm not sure what you mean by DNN only allowing unique usernames. If all the user information is the same (which in an AD situation it will be) then only one user is added but the UsersPortals table will get an added entry (UserID, PortalID) to it.

I don't know if I've helped or confused the situation even more so any feedback is appreciated.

I'm not sure if it answered jon's question, but it answered part of my questions about this scenario!

One other question I had on this...  I won't be able to test it until next week, but how can use use the AD login with multiple portals in a mixed-mode environment?  I seem to remember someone saying that they copied an aspx file to the portals sub-folder...