set up waterfall inheritance model for IT Automation profile:
Customer -> Folders -> Agents
so the deepest can override settings of the above.

Example:
Profile 1 with OS updates applied to customer "A" has "deny manual updates" Profile 2 with OS updates applied to folders "Servers" of Customer "A" has "enable manual updates"

this feature should allow profile 2 to overrule Profile 1 (at the moment they conflict) and there is no way to exclude folders from the policy