Can I “allow logon locally” for ALL local accounts and some domain accounts?

I have used a "Allow logon locally" GPO on a few machines to restrict who can use them. It is annoying that I have to create/link a separate GPO for each set of machines/users (Where is item-level targeting when you need it?), but now I'm running into a more difficult problem...

I need to restrict the AD users that can log in, but also allow ALL local accounts of which I may or may not have knowledge. We have machines created/supported by external vendors who create local accounts for local administration/configuration and/or testing. Those local accounts need to be able to log in, and they are not necessarily in any special, local group.

Is there any way to configure some kind of hybrid between "Allow logon locally" and Group Policy Preferences where I can target specific users/groups to add or remove from local groups without needing to specifically define EXACTLY who is in a group? Basically, I want to layer removing logon for all AD accounts, then allow login to a few, limited AD groups and all while not touching the logon ability of local accounts.

Is this do-able? I'm not opposed to start-up scripts if there is a registry key I can populate dynamically or something.

Thanks.