If like me you like to be a different rule rule on your employees machines from that on your servers then you will create a servers group, move all your servers into an OU so that they are assigned whole through group exclusively an dapply patches from each of each of them to only that group alone.
If like me you like to have a different set of rules for your employees machines to that of your servers then you will create a servers group, move all your servers into an OU so they are assigned that group exclusively and apply your server patches only to that group.