What I want is some kind of exception. My Google Apps organization is large, very dynamic and most members of the organization must belong to a given group G1, still exist some of them that I want to excluded from G1. The perfect setup is add all organization members as group member and have an exclusion list, so each time a members is added to my organization it is added to the G1 group too automatically and in case I want exclude a given user, I must add it to the exclusion list. Is that possible? Or in case that at least one member of my organization must be excluded I must add each member manually?
@gsc-frank, unfortunately, the feature that lets you add all organization members to a group is not as useful as it seems. There is no way to exclude members from the group. In my situation, I'm stuck with such a group, so I distribute (via exported XML) or automatically add (via GAM) a filter that sends mail from that group to the trash for people on my exclusion list.
If you can avoid using this feature, my recommendation for you is to create logical sub-groups that together incorporate all users. For example, a college would have (at a high level) email@example.com, firstname.lastname@example.org, and email@example.com. These groups are usually necessary for communication anyways. Then, instead of adding individual members to your top-level group, just add the three groups as members of the top-level group.
One vital gotcha that puzzled me for weeks: make sure the sub-groups have the same posting permissions as the top level group. For example, if firstname.lastname@example.org should be able to email email@example.com, which sends an email to staff, faculty, and students - the staff, faculty, and students groups must have "post" permissions that would permit the firstname.lastname@example.org account to be able to send mail. This is most disconcerting because it fails silently - without an NDR or error message. Be forewarned. :)