There doesn't appear to be a way to use Limitations on the policy because that only limits by network segment, ad membership, or ibeacons. The only way that comes to mind is to use a Smart Group that looks for members of the static group and has the OS limitations you need. Scope your policy to the Smart Group.

Computer Group member Static Group
and
( Operating System like 10.14
or
Operating System like 10.15)

Should do it I believe.

It's odd that a Smart Group of say Pre 10.14 and Pre 10.15 machines can't be added into Exclusions, no?

You could do it that way too and then just scope it to your static group.

Your smart group could be Operating System Not like 10.14 or Operating System Not like 10.15 (or is it and, I can never figure that out without testing)

@jbisgett your original suggestion worked, thanks!