"It seems that the connector for Directory Service is used only and exclusively to bring users on board and profile them ... not to authenticate them."
Yes, you are correct.
There is an embedded module that handles the Windows authentication in Qlik Sense that is used when "Windows" or "Form" authentication pattern are chosen in the virtual proxy.
This module is not customizable, if you need further options to customize what you use as user name and directory name, I'd recommend you use SAML authentication towards ADFS.
