Shared SSO domain for vRA Management and Payload vCenters?

I'm deploying a Management vCenter and a Payload vCenter for a new vRA 7.0 deployment.

Should these two vCenters share the same vsphere.local SSO domain (using separate external PSCs) or should they each have their own SSO domain? What are the pros and cons to each?

The vRA deployment will use the embedded vIDM so it won't depend on any of the PSCs.

Thanks!!!