@Ruslan Nalivaika Please help me by sharing how you resolved the issue mentioned above, as we are facing the same scenario.
Users from the account forest, who are added to a domain local security group in the resource forest within Active Directory, are able to see all Remote Desktop Services (RDS) applications instead of only the applications explicitly assigned to them.
This is a newly configured setup, and the cx expected behavior has never functioned as intended for users from the resource forest. However, the same configuration works as expected for users from the local domain forest.