Is there an "Active Directory Connector" to map on-prem OUs and Groups to Endpoint Policy Manager Cloud?

No, there is no Active Directory connector. Our feedback is that most companies don't want something reaching into their Active Directory and causing a security concern.