I setup all task at root level, all disabled and all only apply to workstations. I then just break inheritance where I need it and if I need something for servers I double the task and and set that to only apply to servers. This helps quickly show me whats doing what task wise and I can reset inheritance quickly to kill it- I find it also helps keep my mis-click headaches to a minimum.
As for structure I sync to AD- keeping ADs structure and do all my organizing there. All computer objects in the same root then broken out by whatever -servers, site, some instances special containers for special people etc.