Collections for machines that don't get any deployments except OS updates.
We have digital signage that is W7 runs a java app and that's it. It is in the main collection for our company. When we push installs around we have to make sure we have this collection set as an exclusion in all 400 of our deployments. I'd like an option or let's discuss the best way that says, all this software for normal operations goes to the company, maybe it gets deployed by our HQ without local control, but we don't want ANY software going to these machines ALWAYS except for OS updates. Digital signage doesn't need app updates pushed to it like Adobe, or Firefox or Office. Or maybe we have a machine that is a validated test machine that once it gets built, SCCM never touches it.