Hi,
domain keys are not related to users.
DKIM setup is done on the sending side like you have described (in NS) and on a authorisation-validation side, which is a TXT record on the DNS record of the domain with the corresponding selector name and public key as a value (Generate DNS entry button in NS)
when setup is done for multiple domains, for users - user@domain1 and otheruser@domain2 - NetSuite will be able so send legitimate emails on their behalf.