How to configure 2 forest in Bigip APM

You have a few different things going on here. In the absence of APM, a domain-joined client would attempt to pass NTLM (or Kerberos) credentials to a resource directly. But you've configured the Outlook client to use a different user, so the local credentials shouldn't matter here, only the once configured in Outlook. So you're saying that you're seeing a DOMAIN2 user NTLM authentication when you should be seeing a DOMAIN1 user NTLM authentication?