Can you please explain in detail or add a screenshot - how exactly you added the group as an exclusion? For the task you described, I would just create a group and disable the two hardening alerts explicitly in the policy applied to this group. I guess, something is wrong in the way the policy is applied in your environment, you should doublecheck the active policy for the VM and then in policy editing dialog check if the "hardening" alert is enabled locally or inherited.