You need to prevent the service accounts in Windows AD …

Your company plans to migrate from On-Premises Exchange to Office 365.
The existing directory has numerous service accounts in your On-Premises Windows Active Directory (AD),
stored in separate AD Organizational Units (OU) for user accounts.
You need to prevent the service accounts in Windows AD from syncing with Azure AD.
What should you do?

A.
Create an OU filter in the Azure AD Module for Windows PowerShell.

B.
Configure directory partitions in miisclient.exe.

C.
Set Active Directory ACLs to deny the DirSync Windows AD service account MSOL_AD_SYNC access to
the service account OUs.

D.
Create an OU filter in the Azure Management Portal.

Explanation:
One customer, who was looking for OU level filtering to import selected users from On-Premises activedirectory to Office365.
Configure OU level filtering for Office365 directory synchronization.

http://blogs.msdn.com/b/denotation/archive/2012/11/21/installing-and-configure-dirsync-with-ou-level-filteringfor-office365.aspx