A:Hiding Users in Active Directory:
There are two ways to deal with this.
1) The obvious one. Put the users in a container that the plugin is not browsing. The feasibility of this depends on the customer.
2) Another option to hide the users is by setting the description field of the user to 'CiscoPrivateUser' or 'CiscoPABUser'.
B:Hiding Entire Subtree with Active Directory Plugin:
One possible way by which you can filter out specific sub-trees under the USERBASE is by setting the ACLs appropriately on these subtrees.