Looking for Suggestions on granting all users access to an application *except a subset of users*

Question

This might not be the right forum for this question, but since it is related to an App-V application I figured I would try since this may have come up for some of you.  I am looking for the best way to grant all Domain Users access to an application
except for Domain Admins.  Using the Full App-V infrastructure, I want to grant access to the App-V UI via User Targeting, but I don't want to allow Domain Admins access.  The reason for this is because when we make updates to provisioned
server cores (stateless), we login with our Admin accounts to make modifications to the cores, and I would like to reduce the steps that need to be taken at the end to ensure that all AppV applications are removed before sealing up the core. 
Currently, Domain Admins do not have access to any App-V applications, so this process is fairly clean.  All applications are User Targeted. 
Packages are cached on a persistent D drive on each server, so the issue is that the registry, programdata, and packageinstallationroot become out of sync if packages are pulled down during core modifications after the core is attached to other servers (hence
other D drives).  Because of this, Machine Targeting is not an option for this either.
 

Answer 1

This would be so much easier with a "Configuration Manager" like feature where you could create a collection query to accomplish the same thing.  Are there other tools out there that will do the same thing?