In ZENworks 7 we could exclude a user in a group from getting a force run app by adding that user to the associations tab and ticking off the force run option. For example if we had an app associated to "All staff" that was force run and user "Joe123" is in the group "All staff" when he logs in the app is run. If we add him to the app association along with "All staff" group and turn off force run for him it won't run when he logs in.

I've tried this with ZCM 11 but it doesn't seem to work.