These systems are not connected to the internet so there is no way for them to automatically update java, we have to push them out.. (these are the systems on that specific build)

Trying to figure the easiest way to do this, I want to block those systems from getting the java updates, but continue to update the rest of the domain..  

With all of this being said, would I be better off creating two patch management tasks, one for just JAVA and exclude these systems or is there a better way of accomplishing this?