Grant minimum required permission for adding computer to a domain - without using delegation

Following principle of Least-Privilege Administrative Model I need to create custom group that would give its members permission to add computers to a domain but nothing else that could pose a security risk.

So I created my custom group in AD (let's call it "Domain Manager") and assigned test domain user to this group.
Then I went over to Group Policy Manager and created GPO. Inside my GPO I went to Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment. and added my custom group to Add workstations to Domain policy.

Exactly following Method 1 from this article: https://www.prajwaldesai.com/allow-domain-user-to-add-computer-to-domain/

Next I linked GPO to an OU with a single computer just for testing (and ran gpupdate /force for good measure). I removed this computer from the domain and tried adding it again with credential of my test user (added to custom group) - it didn't work (got Access Denied error). Next I tried doing the same but assigning GPO to the whole domain - again the same error.

I've searched some more and found this note from Microsoft https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/access-denied-when-joining-computers

And it makes sense, as my testing computer was previously in the domain so I would need to reset password. But I'm not able to find this settings inside the GPO.

Is it possible to achieve this without using delegation? Am I missing something inside GPO?

This capability usually requires more than that AD right. What you should do is create a group, and assign that group Create/Delete Computer objects permission for an OU, and the appropriate/desired permission at the OU for descendant Computer objects (delete/modify/custom permission). You can do the same for the Computers container, but it's more organized to not use that and create the Computers in the correct target OU to start with.

Ok, you have created a GPO policy for that, but you did not applied it correctly. The policy must be linked to OU with domain controllers, best to link it to the domain. You just assign that GPO policy to the specific security group and then it will work.