A Workgroup is a collection of machines that may or may not be part of a domain. Separating machines into workgroups allows you to keep better control of resources, especially in large environments. Domains work like this too, but one level higher. Where I work, we have two domains set up, and I can set "trust" relationships between them to control which servers and/or machines can be accessed from what domain. Trusts can be one- or two-way between domains.
If you want more info, PM me and I'll answer any questions you have... it's late and that's a very simple explanation...
Dave