I tried and figured it out. The answer is that org2 user msp does not matter. When the client app belongs to org1, you need to configure only users of org1. It makes sense that org1's client app should not have to know anything about org2's user.
Assume that a chaincode is deployed on peers of 2 orgs, and I am a client of org1 that have signing keys of only users of org1, but the transaction must be endorsed by both org1 and org2. I guess that you do not have to have the signing key of a user from org2 to make it work. Correct? When using fabric-sdk-go, you need to specify a network config yaml, which lists multiple orgs, e.g., in the following config, how should I config the org2 msp if I do not have any user crypto data for org2?