"Thumbs Up" to SebastianZ
You'd need to use the GPO to perform the initial install if you want it going by OU. After that, the clients within the OU in questions can be upgraded follwoing Brian's steps
There's also the SEP-Integration Component for Altiris if you want:
http://www.symantec.com/business/support/index?page=landing&key=56176