Not sure I follow... no local administration required. Everything is done at the OU. GPOs have an ACL so you simply remove whoever you don't want it to apply to.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.