It sounds like some of the apps are authorized at the user level instead of at the OG , we have all of our shared device go to a default OG = to the one the user will log in using and have all our apps mirrored for both OGs that way it never pulls them, however when I personally log in to a shared device using the same OG a user would several apps are added since my test account is listed under additions in many smart groups.