Running virtual domain controllers outside the StarWind vSAN cluster sounds like a smart workaround. It avoids the “chicken-and-egg” problem, and since Microsoft supports this setup in Windows Server 2016 and later, it should work reliably.