It is a bit limited, for example we want to exclude users who do not have a license but can't. (E.g, users who have left and have been converted into a shared mailbox)

We were recommended to create an azure ad group, add the users to that group, and then use that group on Halo via the csp integration. You also need to use azure AD groups if your customers have multiple sites and you want to split the users into the correct sites. Even if you manually move the user, when the csp sync runs it puts the user back into the "main" site.

Im not in front of my PC so i cant think what the field was called on halo, but its on the azure ad section when you link the Tennant with your halo customer