To achieve granular control over YouTube access within your Google Workspace organization, allowing access to a select group while restricting it for others, the recommended approach is to use organizational units (OUs) in conjunction with service settings exceptions. You would apply a policy to restrict YouTube access at a higher-level OU (encompassing most users) and then create a child OU containing the select group, where you override the inherited policy to allow YouTube access.

The key information here is "only five users" and "Agency users must have their original email address. You have added the agency's domain as a secondary domain." For a small number of users (five), manually creating them in the Admin console is the most straightforward and least complex method. When creating a new user, the Admin console allows you to select the domain for their primary email address from any secondary domains you have added to your Google Workspace account.
Here's why the other options are less suitable:
A . Use the Directory API to automatically create the user accounts. While the Directory API can be used for automation, it requires scripting or programming knowledge. For just five users, this is overkill and introduces unnecessary complexity.
C . Use Google Cloud Directory Sync (GCDS) to sync users from an existing directory. GCDS is designed for syncing large numbers of users and groups from an on-premise directory (like Active Directory) to Google Workspace. For only five users, and if there isn't an existing directory that needs ongoing synchronization, GCDS is far too complex and unnecessary.
D . Bulk upload all users using a CSV file. Bulk upload using a CSV file is efficient for a larger number of users (e.g., dozens, hundreds, or thousands). For only five users, preparing a CSV file might take as much or more time than simply creating them one by one through the graphical interface, especially if it's a one-time task.
Reference from Google Workspace Administrator:
Add users one by one: This method is explicitly recommended for adding a small number of users (e.g., 10 or fewer). During the user creation process, you have the option to choose the domain for the user's primary email address from your available domains.
Reference:
Add a domain or domain alias: This is the prerequisite step mentioned in the question ("You have added the agency's domain as a secondary domain.") which allows you to use that domain for user email addresses.

Granting delegated access allows the executive administrator to manage the executive's emails without requiring access to the executive's password. This solution ensures security and privacy by limiting the permissions to email management only, while keeping the executive's account secure. The executive administrator will be able to send, read, and delete emails on behalf of the executive, but they won't have access to other aspects of the account.

Using the Data Regions function in the Google Admin console, you can specify where data is stored for different organizational units (OUs) based on their geographical location. This ensures that employee data for those in Germany is stored within Europe, while data for US employees is stored within the US, meeting the regulatory requirements for data locality. This approach automates compliance and eliminates the need for manual tracking or additional configurations.

A HAR file (HTTP Archive) records detailed information about the user's network activity, including HTTP requests and responses. This file can help diagnose issues with Gmail loading slowly or errors occurring, especially when they are intermittent. By generating a HAR file, you can provide valuable data for troubleshooting the issue and pinpoint any underlying network or browser-related issues.