Unsanctioned to all, exclude to some

Dear reader,   I have configured the asset rules en device tagging.    I need to deploy certain apps as unsanctioned to all W11 devices and exclude the same apps to certain devices who have a dev...