Based on your answers in the comments and chat, I think you're making this much more complex than it needs to be. You should not be using Loopback processing unless you have very specific reasons you need it.
To make the GPO block the Control Panel from all users in the
Contractors group on any computer, you will want to:
- Remove the Loopback part of the GPO
Authenticated Users from the GPO security filtering
- Remove the
OU_One OU link
- Add the GPO to whatever OU contains the actual users that are in the
Contractors OU (note that the Security Filtering means you could apply this GPO at the Domain level, if the contractors are spread out too much)
Security Filtering only uses groups as a way to organize things (users, computers, etc). The things (users, computers, etc) must still be in an OU the GPO is linked to.
Loopback filtering is generally used for things like changing User policies on Terminal (Remote Desktop) servers, where you want to apply user settings but only on specific computers.