KACE Product Support

I am trying to create a label to manage patching through our Kace 1k appliance. We keep all of our computers that get group policy and windows patches in one OU and any computer that can not recieve system updates automatically in another OU. Both of these are at the same level in AD. So for example we have OU=Patchable,DC=domain,DC=com and OU=Nonpatchable,DC=domain,DC=com. I went in and created a label entered the necessary server, port, username and password info. In the base DN: box I used OU=Patchable,DC=domain,DC=com and under advanced search (&(objectclass=computer)(objectcategory=computer)). If I go to the LDAP browser and enter the same information and then search I get the correct list of computers in the search results. The problem I have is once I enable the LDAP label it is also applying that label to computers in the nonpatchable OU. What am I missing here as I would expect it to only apply it to those computers that come up in the search results.