Generally I take the exception settings out a broader policy and into a new one, then assign to 'All' excluding a group of users or devices. If required I set up a corresponding policy with the reverse or different setting, and assign to a group of users or devices.

I struggle getting onboard with all "Intune" things being under Endpoint Security, as it's not just for Intune managed devices; but I agree that there should be consistent wording and tooltips for settings across all areas of Intune.

Nope, KSP is free to use 😍