Disable SEP client from SEPM console

Good Day,

           So here is the issue.  I manage an environment of about 18000 endpoints, mixed environment (SEP11/12).  SEPM is at 12.1.4.MP1a.  I want to be able to create a test group where I can move clients to that I want to temporarily disable SEP on COMPLETLY.  I get alot of requests from the intel/deskside team to disable a client for testing purposes. 

I created a group with these settings, Tamper protect is OFF, auto-protect is OFF.  is this enough? or do I need to do anything on firewall rules aspect?

Thanks