Problem understanding GPOs and assignment to users/computer via groups

Hello, I am trying to get my head around a problem which i cant seem to find the right answer to. Situation is multiple laptops and pcs. I want to manage most GPO assignments via security groups. I have a default GPO assigned to the computer OU. A number of users have a specific GPO assigned to allow them Local Admin rights via a user group. That group is linked to the Computer OU an has a restrict access within the GPO for the specific security group with admin/remote access rights. works well. Now I want to give a number of people special rights on their PC. For example I want location services to be available and allow MS account usage for private account. I thought I can create a security group called MS-Service with Users as members same with the local admin GPO - create a GPO called MS-Services - assign that GPO to the Computer OU - and in the delegation tab i untick apply GPO in authenticated users and add my MS-Services security group as "read and apply GPO". What I expect now is my current AD user to update the GPO and have special rights on my PC for private user accounts etc. Running this command gpresult /r /scope:computer shows that the rule was not applied "Filtering: Denied (Security)" running the gpresult /r /scope:user will not show any applied GPOs. Sounds to me like my microsoft service GPO is not applied in any case. Can I not apply computer wide GPO to Computer Objects and link the GPO to users similar to my local admin GPO? Do I have to make the Computer part of the security group? I am just trying to understand how i can successfully link GPOs to Users or Computer wide setup