there is really no need to change your OU structure in this case: you can use WSUS client side targeting feature to group computers into "WSUS computer groups" and then approve updates to pre-production group prior to deploying them for all client
computers.
Here is a simplified example of what you can do:
Create a "common update settings" GPO that specifies WSUS location, update schedule and other update options. Link this policy to OUs containing your client computer accounts, so that the policy will apply to all clients.
Create a security group for "test clients". Manually add test computers to this group.
Create a pre-production update GPO, link it to computer OUs and use security filtering to limit GPO scope to "test clients" group. Turn on "Windows Update\Enable client-side targeting" policy. Type inn computer group name, for
example "Pre-production". Create Pre-production group in WSUS. Computers that are members of the "test computers" security group will now automatically appear in pre-production group in WSUS. When new updates arrive, you can first approve
them for pre-production group only. Once tested, updates can be approved for all computers group.
Gleb.
