This message was deleted.

We separate them entirely. I couldn't imagine trying to run an environment in which the same policies that apply to physical also apply to virtual, and expect good results.

Multiple OUs with block inheritance

And loopback

Always separate, block inheritance, loopback, etc for use cases.