TBH you dont need to use tags to do what you are trying to do, just use the deployment task at the group level set to run immediatly and push out VSE 8.5/8.7, if the machine already has the desired version it wont update, if it doesnt, it will...simple as that