Operating Systems are found through the FireSIGHT process (now called AVC). This is a passive process.
There is not an option to create objects based on OS types, thus no way to enforce on that object.
The FireSIGHT process is meant to be informative for the security engineer. It allows you to be be aware and to discover systems you might not have known were on your network.
If you want to block / black hole an OS, you need need ISE. ISE can make differentiated access policy decisions based on the OS when doing posturing.
