Well typically you would not have Servers in an OU with Workstations.

Apply ACL to whomever you wish to run or not run.