Create a security group of computers and use that in the delegation section in group policy?

I need to create a group policy to install some software on all computers except for virtual computers.  My idea was to put all virtual computers into a security group called VMs and then use that in the delegation section for group policy and deny them access to the group policy.

Is this the best route to accomplish what I am trying to do or would something else work better?