Our entire build process is built around AD group membership. We use two different OUs. One called Staging which is where the device gets the core build of Anti-Virus and Endpoint Control. We then move the machine into a Departmental Based OU which determines what further software needs to be installed. The tasks are all policy based which allows you to control bandwidth consumption.
So, for example, a machine is dropped into the Sales OU.
Core syncs with AD (configurable schedule). We have ours set to 20 minutes (we are a fairly small shop ~2500 users). You place the AD based Sales query in the tasks assigned to that department. Again core based schedule. We only have ~800 queries which only takes about 16 minutes to complete.
So to summarize:
-Core determines OU membership.
-Departmental query based on OU which is assigned to all required tasks(policies). We put numbers at the beginning of the task names so we can control the order and minimize the reboots required.
-Machine checks for policies, finds all of the policies, and queues them up in task order.
I hope this all makes sense. I can provide some screenshots of how we structured it if you'd like. We used this structure to build all of our machines in our Win7 refresh and it worked almost perfect.