Local Security Policy

Where is the policy being applied from? Is it being set at the local machine, or is it a domain-wide policy?
If at the local machine, generally the GPO is applied against all users of the computer. However, the local group policy uses the Read attribute of the Group policy object folder
(%systemroot%\System32\Group Policy) to administer the policy. Therefore if you remove (not Deny) the Read permission for the Administrators group, that group will be unable to read the policy and the policy will not be applied against that group. In order for an administrator to make further changes to the policy, an administrator must take ownership of the folder, re-enable Read access, make the change and remove the Read access.
If the policy is being applied across the domain, you have to take a different route. The key is the order in which AD applies GPOs (Local machine, Site, Domain, Organizational Unit -- LSDOU). The easiest way to do what you want is to create an OU and move those users against which you want to apply a given GPO in the OU. Create a GPO and apply it against the above OU. Since the GPOs for OUs for OUs are applied last, you can in effect have a domain GPO that is wide-open and still lock down computers for specific users.
Hope this points you in the right direction.