It's pretty easy basically.
You can do things like "Owning Department == Accounting" or "Code == Blue" ... and then have dynamic queries associated with that (which just resolve "all devices that are part of this custom data").
You THEN use these queries in SWD-policies ... and thus "all Accounting needs VISIO ... so anything with a DEPARTMENT value of ACCOUNTING is assigned to the VISIO installer package" for instance.
A lot of this comes down to "how your org works", but the use of dynamic queries (and/or LDAP groups of devices/users for instance) can all be used to target "anything" .