To narrow the scope of GPO create OU with only WSUS server(s), or create security filter for sec.group with only computer accounts of WSUS server(s):

details:

result should be like:

 … Read the rest