We use groups for Internet access: Blocked, Filtered, Relaxed and Unlimited.

I need to be able to report on all users that are in none of these groups. As long as they're in at least one of them, they should not appear in the report.

There are many scenarios where this information could be useful: Users not in the "All Users" mail group for example. If you can filter by listing users only in certain OU's rather than only at the domain level, then reporting on sites users not in site-specific mail or security groups.