From what I understand, you want to share a secret to B in such a way that every single member of B is required to reconstruct the secret. In that case just use a threshold secret sharing scheme where the threshold is the number of players in B. This ensures that no subset of players in B can reconstruct the secret.
I’m not convinced you need encryption here ...
would using S = r + H(A, M) be a secure variant?
Actually, it would become trivial to generate a signature for an abitrary message with just the public key.
The verification check would be:
$$2^h s G = 2^h R + 2^h H(A, M) A$$
where $h$ is the curve cofactor, $G$ is the curve generator, $A$ is the public key, $M$ is the message and $(R, s)$ is the signature.
This answer is assuming you are not removing the private key $a$ from the computation of $S$, and instead actually meant what is said in the title of the question:
$S = r + a H(A, M)$
Removing $a$ from the computation would be terrible.
The first issue that comes to mind is malleability, on top of collision resistance.
The signature process for EdDSA ...