How to apply a cloned web control to devices, not to users?

Hi I created two devices groups, staff and students. Staff is going to work with the base policy, and I cloned all the policies and made changes for students. I only could apply the cloned policies: Threat Protection, Peripheral Control, Application control and Data Loss Prevention. For the following 3 policies I do not have the option to apply them to a device group, only to users: Web Control, Update Management, Windows Firewall.

Is there a way to apply those 3 policies to a device group?     

Cheers!