Regarding the use of DnsUpdateProxy group, it is my understanding that only the DHCP Servers should be member of that group, not the dynamic DNS update user.
The user account is supposed to be added to the DHCP server configuration, not to the DnsUpdateProxy group.
The DnsUpdateProxy group is for DNS Clients. The user is not a client, it is a mechanism used by the client (the DHCP server) to make dynamic updates to DNS when you have secure updates only turned on. The client remains the DHCP server.
When the DHCP server is on a DC, in addition to making the server member of the group and adding the user to the DHCP configuration, you also need to set OpenACLOnProxyUpdates off. If you don't you are adding a vulnerability, because membership in the DnsUpdateProxy group gives too much authority over the DNS records.
Some schools of thought suggest that DHCP on a DC should not be member of DnsUpdateProxy, and only should have the DNS update user assigned to DHCP. That may be true for older Windows Server but for 2012R2 and later, the sense I have from the tech docs is that the server should still be in the DnsUpdateProxy group, but because of being a DC, that group membership's permissions opens up the vulnerability.
So, if you have DHCP on a DC with secure dynamic DNS update enabled, you should also run this command on the DC that is running DHCP, so its DNS won't allow "foreign" updates to change records owned by DHCP:
dnscmd /config /OpenAclOnProxyUpdates 0
Bottom line - the DnsUpdateProxy group is not for any user object - it should only be used for DHCP server objects (DHCP clients), and is primarily intended for the "best practices" of having your DHCP server on a non-DC server, to impart the necessary permissions to dynamically update DNS. Adding the secure update user to that group serves no purpose.