Can you try to test a different group besides Domain Users to test and entitle that group in Horizon? Make sure that group is underneath the Base DN for sync.

Have you successfully setup WSO Access as the SAML authenticator on the Horizon side?