Organisation Security Profile: Include vs Exclude

Content

In a scenario requiring several different Organisation Security Profiles, each with many (>100) Organisations controlled, is there a recommended method on whether to use an 'Include' or an 'Exclude' approach?

The Include approach would use 'Secure by Organization List'. Each Organization would be added to the Organization list separately and marked as 'Include'.

The Exclude method would use both 'Secure by Organization Classification' and 'Secure by Organization List'. The appropriate Classification would be set and then specific Organizations from that Classification requiring exclusion would be added separately to the Organization list and marked as 'Exclude'.

I believe either method would achieve the desired outcome in terms of limiting the Organizations available to the user. A HDL template will be used for initial set up so the number of Organizations to either Include or Exclude is not a key factor (and are pretty similar in number via either method).