I know it’s been a while, but I thought I would give an update to this.
My Thunderbolt dock’s USB ports have been working well with a separate USB qube for them. In addition to assigning the dock’s USB devices to the new qube. I also needed to update the mouse policy to allow USB mice connected to the dock to work. I decided to block USB keyboards (the default behavior) because the dock emulates a USB keyboard, and I can think of no sane reason for that.
Networking works with some babysitting. I created a sys-net-dock qube for the dock’s ethernet port, to keep the device off dom0 if nothing else. I can manually move the firewall between the 2 net qubes, but I haven’t figured out how to automate it. Good enough.
The dock’s DisplayPort, audio, and card reader work with no tinkering needed. The DisplayPort goes to dom0 and extends the desktop. The audio and card reader get managed like any other USB device.
Hotplugging remains a non-starter. I need to plug it in before booting Qubes. Other than that, everything seems to work.