Active Directory: MachineAccountQuota 0 vs SeMachineAccountPrivilege and per-user computer account limits

Working on remediating "Non-privileged users can add computer accounts to the domain."

Current default:

• ms-DS-MachineAccountQuota (MAQ) = 10
• SeMachineAccountPrivilege granted to Authenticated Users

Requirement: one service-account group should be able to join machines, max 10 per account, while everyone else should have 0.

Proposed solution was MAQ=0 + GPO granting Add workstations to domain only to that group.

My understanding is that this won't work because SeMachineAccountPrivilege is still subject to MAQ. With MAQ=0, the group would also have a quota of 0.

The two approaches I see are:

A) MAQ=0 + delegate Create Computer Objects on a specific OU to the group. → Everyone else blocked, but the group effectively has unlimited creation rights in that OU.

B) Keep MAQ=10 + remove Authenticated Users from SeMachineAccountPrivilege and grant it only to the group. → Group gets 10 per user; everyone else gets 0.

Questions:

1. Is MAQ=0 + GPO-only definitely a dead end?
2. Is there any native per-user/per-group MAQ mechanism?
3. Is the quota cumulative via mS-DS-CreatorSID, meaning deleting a computer doesn't necessarily free the quota?
4. Which approach do you typically use in production: A or B?

I'm leaning toward A with OU scoping + monitoring, since the "10" requirement seems more like a security cap than a hard compliance requirement.