Seeking gpo ideas for a build ou

We utilize a 3rd party company to deploy our end user devices (laptops/desktops). For the most part they are pretty good with building them and moving to proper production ous after the build but sometimes they leave them in the deployment ou where they do not get all the group policies we want applied.

I’m thinking of group policies that we could apply to the deployment ou to notify the account is in the wrong location within ad.

So far I’ve thought of background desktop image, pre logon banner, and maybe even setting a “deny log on locally” policy to that ou.

I’m sure I’m not the first one to run into this so looking to see what creative ideas you have come up with.

We have also raised this with the 3rd party on the process side but I’d still like to have something policy wise in place.