How can I set up B2B collaboration with cross-tenant synchronization for users (authentication) and groups (authorization) between two Entra ID tenants?

In my current setup, I have two tenants: one for employees and another for external users. Using AD Connect, I am syncing users and groups from two on-premises Active Directories — one for employees and another for outsourced users. After syncing with AD Connect, the users and groups are present in Microsoft Entra ID.

Now, I need to authenticate and authorize users only through the employees’ tenant. For this, I want to set up B2B collaboration to sync both users and groups — users for authentication and groups for authorization.

How can I achieve this setup?