Steps to reproduce

1) Create new application fisheye in crowd
2) Add an LDAP directory and set "Allow All to Authenticate" to "False" for the "LDAP" group
3) Then add to the Groups tab one specific group in LDAP which only contains a small subset of users
4) Configure fisheye to communicate with this Crowd server
5) Select re-sync and this will add all the users in LDAP rather than just the ones that belong to the configured group.

If you need to get rid of all the users that you have imported already via the sync, you should point fisheye to an directory within crowd that only has one user, and re-sync. This will delete all the users except for the one in the directory. Next you can go to Administration > users and delete that user and add the ones you need to, and update your crowd details to point to the correct directory.

If you have a small number of users that you want to add to Fisheye my suggestion as a workaround would be to manually add the users into fisheye, and disable "auto-add" and "synchronise users with crowd".

1) Go to Administration > Security > Crowd Authentication and set "Auto-add" to "Users must be added to Fisheye manually" and set "Synchronise users with crowd" to "No".
2) Go to Administration > Users, and manually add the 10 users that should have access.

If you have a large number of users that you want to add to Fisheye my suggestion as a workaround would be to let the users auto add into fisheye and disable "synchronise users with crowd"

1) Go to Administration > Security > Crowd Authentication and set "Auto-add" to "Create a FishEye user on successful login" and set "Synchronise users with crowd" to "No".