I need the ability to filter out a SUB OU from an LDAP label.

We have our AD organized by city, then under the city a couple of special OU's such as IT Computers. I need to exclude the IT computers from patches applied to the OU above it since they have their own schedule for testing purposes.