Group Exclusion when deployment is targeted to a Group

I want to deploy software via a configuration based on group membership of the target computer. However I want to exclude certain computers if they are also members of another group.

For example;

Install App1 to all computers in AD group Finance1, but not if those computers are also in group Finance2.

I am able to successfully exclude PCs in a group if I install based on the domain or the OU of the computer, but not when install is based on a group.

I configure the first group as the target, then tick the box to Exclude Target, click the Browse button next to Group, select the group I want to exclude, and press the Add More Targets button at the bottom, and the target group then appears in the List of Targets, but the Excluded Items field shows -None-.

Is this a fault? Are is this working as currently designed, and I should then propose a new feature?