Groups are completed even when not imported

Groups are not imported in my LDAP configuration in owncloud. I tried both an empty filter and a filter like this:
(&(|(objectclass=group))(|(cn=idonotexist-2323942)))

Yet, when I enter a group that exists in active directory and I type it exactly right it will be recognized and shown as 'SomeGroup (group)' in the dialog.

This has 2 consequences:

1. users share with groups that do not exist in owncloud (like their departements) and are confused when it does not work
2. it's a serious security flaw. How does owncloud even know about these groups if I chose not to import them?

Regarding 2.): I checked the owncloud database and found that 'oc_ldap_group_mapping' contained all 950 groups from our AD. Why? I chose to filter them because I do not want to expose that interal information on a semi-public web application.

Start by reproducing the LDAP configuration with an empty or nonmatching group filter, then inspect how filtered groups reach the oc_ldap_group_mapping table and the sharing dialog. Done means groups excluded by the configured filter are not imported, mapped, or offered for sharing, while permitted groups still work.