The problem is that you are saying in your SQL that you want all the results  where the patch ID is not equal to KB943729.  That means you are going to get every machine with any KB installed as long as the line does not have that particular KB in it.  This should do the trick so you only look for that particular KB and exclude all machines with it currently installed:

--What this does is select every computer from the vComputer view
--and then exclude all those resources from the OS Updates table that have the patch installed.
Select guid from vcomputer
where guid not in
(Select _ResourceGuid as guid
 from Inv_AeX_OS_Updates
 where [Patch ID] = 'KB943729')

The exclusion method is probably a less complicated way to go however. If you just take a collection of all machines, then exclude all those with that kb installed, then as you get it installed, your push list will shrink by any machines that have installed it.  Either way you get the same result, so take your pick.

Hope this helps.

Mike

There is another way to do this as well, same result:

SELECT Guid
FROM vComputer vc
LEFT JOIN Inv_AeX_OS_Updates upd
ON vc.Guid = upd._ResourceGuid
   AND upd.[Patch ID] = 'KB943729'
WHERE upd._ResourceGuid IS NULL
AND vc.IsManaged = 1  -- only machines with Altiris Agent installed