We are considering implamenting WSUS at work. The biggest question is using groups. If a machine is made a member of two different groups, and one group is approved for an update and one is not, will that machine be approved for that update? Most products from microsoft use the philosophy of 'most restrictive', but I can find no evidence of this in WSUS.
WSUS computer groups are not the same as AD groups. In WSUS a computer can only belong to one group at a time. So Group:Computer is 1:M (one-to-many)
This differs from AD where Group:Computer is M:M (Many-to-Many). You can put many computers into a group, and any computer can belong to many groups at any one time.