CA SSO : How to provide access to multiple groups which are in the common OU?

Hi,

What is the best way to provide an access to multiple groups which are in the common OU meaning UserClass= OrganizationalUnit (instead of UserClass=group and Allow Nested groups)?

Thanks,

Dhilip