Pass-through is a feature of Windows authentication. It's not related to SQL Server at all, and it's "on" by default (I'm not sure if there's a way to turn it off, now that I think about it).
Which accounts you use depends on the environment, and how the permissions are configured on the backup share. I'm assuming in this scenario that the copy job will be a "pull" from production to QA (in other words, the backup share exists within the production domain).
If domain trusts are configured such that a principal on the QA domain can authenticate against a production resource, the backup share (folder) permissions can be directly modified to give read access to whichever QA domain account/group is being used (they don't have to match at all). Some environments allow this kind of configuration, while others don't. If you don't know the trust configuration between the two domains, ask your Windows system administrator.
If there are no trusts configured between the two domains, then you'll need to use pass-through authentication. This is set up by creating identical AD accounts (matching user name + password) on both domains. Assuming appropriate permissions are configured on the backup share (folder) for the production account, the Windows authentication system will automatically handle the rest of the process.
See these two TechNet articles for more information about domain trusts and pass-through authentication.
