I did not see an easy way to create an exclusion for a sub-OU in the Admin Console. It would be helpful to either turn off automatic sync of sub-OUs of synced OUs or to be able to create specific exclusions to automatic inheritance. It would also be helpful to be able to do a manual sync of Google as your Identity Provider so that troubleshooting can be accomplished without being required to wait till the overnight sync to see if changes work successfully.