Filter by Google group instead of OU. Allow customers to switch this on.
My users and OUs are auto created and managed with a script. A request has come to me from administration to assign users who abuse their privileges restricted internet access instead of removing their network access. The typical solution would be to create an OU for this and drop the users in this OU, but the automation script we have in place will set these users back in the correct OU nightly.