We set up filtering based on a group, in which we have one test user.
Questions: does syncing only delete users on Azure AD if the user has
been deleted from the local AD?
most importantly: our existing users on O365 which are not yet part of
he filter (group) we use to configure the sync: they will NOT be
deleted? (I'm assuming this but would like confirmation).
If a user is synced and then becomes outside of the scope of the group (or OU) that is filtered at that time the synced account will be deleted in Office 365 (with a grace period of typically 30 days). So if you delete that user in local AD it is synced and deleted in Azure AD. If you remove the user from the "UsersSyncedWithTheCloud" group then it is deleted from Azure AD. So don't think that you have to delete a synced user in your local AD in order to delete the user account in Azure AD.
The existing users in Azure AD will stay there unless/until you match them up with a local AD account. It's been a few years since I've done this, but in the dirsync days this was done via Primary SMTP matching (hint: the primary SMTP address is the local AD proxyAddresses attribute that has SMTP: in front of the email address -- anything else with the letters smtp at the beginning have to be lowercase smtp and AD does not validate having multiple entries starting with SMTP:). If the primary SMTP value in local AD matches the primary SMTP value in Azure AD the account is linked (if there isn't a duplicate) and an ImmutableID vaule then links the two accounts after that.