I agree Managed AV Groups would be highly beneficial for differentiating between workstations and servers, as well as for managing groups of servers, such as DMZ versus internal. The ability to assign policies based on tags would also achieve the goal.