You can tweak your posture policies to match on more specific things such as conditions OR endpoint groups. For example, some conditions that you can match on may include device type, location, external AD groups, etc. To add additional conditions that hosts must match to hit a posture policy or not hit it edit the rule you want. From here you can go to other conditions and tweak the policy to what you want. If you want to match identity groups that will be in the column next to the rule name. The main thing is figuring out how you want to separate hosts you want to hit the posture policy versus hosts that you do not want to hit the policy. IMO your easiest bet is probably by endpoint groups OR external AD security groups.
HTH!
