I actually just ran into a very similar issue we wanted to exempt an AD imported user group from certain policy's in relation to token usage. Opened a support case with Sophos and basically found out you cant for us moving users or machines to other OU…