Hi David,
If you just configure [multiple authN](https://github.com/GluuFederation/oxAuth/tree/master/Server/integrations/basic.multi_auth_conf) servers in your Gluu server, then user1 ( of one.com ) will perform authentication with one.com and user2 ( of two.com ) will use two.com for authentication.
You can keep all users under one tree ( ou=people,o=gluu ) of your Gluu Server but during authentication they will just use their corresponding authN server ( one.com or two.com ).