Scripting

http://www.snowland.se/2010/03/10/sccm-module-for-powershell/

This powershell module does all the WMI for you.

For the query, use a subselect, but instead of using two collections, which is messy, use the query below for a single collection. It does the following:

All computers with *firefox* that isn't version 12.0.0.0, that has a OS named %Workstation% and is in the OU Computers and has the SCCM Client installed.

 select SMS_R_System.ResourceId, SMS_R_System.ResourceType, SMS_R_System.Name, SMS_R_System.SMSUniqueIdentifier, SMS_R_System.ResourceDomainORWorkgroup, SMS_R_System.Client
 from  SMS_R_System where SMS_R_System.ResourceId in
 (select SMS_R_System.ResourceId from SMS_R_System inner join SMS_G_System_ADD_REMOVE_PROGRAMS on SMS_G_System_ADD_REMOVE_PROGRAMS.ResourceID = SMS_R_System.ResourceId
 where SMS_G_System_ADD_REMOVE_PROGRAMS.DisplayName like "%Firefox%" and SMS_G_System_ADD_REMOVE_PROGRAMS.Version != "12.0.0.0")
 and SMS_R_System.OperatingSystemNameandVersion like "%workstation%"
 and SMS_R_System.SystemOUName like "DOMAIN.int/Computers"
 and SMS_R_System.Client = 1

This only works for 32bit software. If you want 64bit you need to use SMS_G_System_ADD_REMOVE_PROGRAMS_64 instead. If you want to do it on GUID use SMS_G_System_ADD_REMOVE_PROGRAMS.ProdID

Is this what you are looking for?  A SCCM subselect query?  (At least the first part of the article) .  In that example it's looking for displayname which you could also use.

http://blogs.catapultsystems.com/mvrabel/archive/2013/05/08/sccm-2012-sub-select-collections-%E2%80%93-getting-everyone-who-%E2%80%9Cdoesnt%E2%80%9D-have-java-7-cu13.aspx

Thanks Ifan and bretthexum!
This is exactly what I need. I'll give it a try and hope that it works.