Virtual Service Accounts - how do I have a GPO which specifies these accounts can be in the local administrator group?

Question

A bit of background to the issue, I've got some software which creates virtual service accounts which are added to the local admin group. This software does not support validating accounts based on groups, it needs to see those accounts in the local admin group.

I want to have a GPO which removes unauthorised users from the local admin group however I want the virtual service accounts to remain in the local admin group.

Any ideas how this can be accomplished?