Thanks for the reply Brian...
So for the standard Intrusion Prevention Policy I can see how that would work, but "Custom Intrusion Prevention" is up top in the "Location-Independent Policies and Settings". And I should have stated, these are OU's, not groups, so I can't (easily) just create a new group and assign a different custom policy to it. Make sense...or am I missing the boat?
-Mike