Writing a custom claims issuance rule - windows

Question

For a specific use case, we need to add external users to our AD and allow these to login through AD FS to an external service.
Everything was set up with only internal users in mind, so we wrote a claim rule as follows:
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"), query = ";sAMAccountName;{0}", param = c.Value);
Basically, this is LDAP Attribute "SAM-Account-Name", and Outgoing Claim Type "Given Name". This works well for internal users.
For external users, there's a use case where the user name in the external site should be the email address used in AD. The easiest thing would be to fill in the email address in the sAMAccountName, but it doesn't allow # symbols.
So I was messing around with claim transformation rules, and figured I could try to add two conditional claim rules, as follows:
Internal users:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Value =~ "domain.com$"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"), query = ";sAMAccountName;{0}", param = c.Value);
External users:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress", Value !=~ "domain.com$"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"), query = ";mail;{0}", param = c.Value);
The first claim rule checks if the email address ends with "domain.com", and if so, it will use the sAmAccountName (internal users).
The second claim rule does the reverse: if it doesn't end with "domain.com", it will use the mail attribute (external users).
But pity, it's not working (either one tested separately).
What's wrong with my approach?