You need to prevent the service accounts in Windows AD from syncing with Azure AD

Your company plans to migrate from On-Premises Exchange to Office 365.

The existing directory has numerous service accounts in your On-Premises Windows Active
Directory (AD), stored in separate AD Organizational Units (OU) for user accounts.
You need to prevent the service accounts in Windows AD from syncing with Azure AD.
What should you do?

A.
Create an OU filter in the Azure AD Module for Windows PowerShell.

B.
Configure directory partitions in miisclient.exe.

C.
Set Active Directory ACLs to deny the DirSync Windows AD service account
MSOL_AD_SYNC access to the service account OUs.

D.
Create an OU filter in the Azure Management Portal.

Explanation:
http://blogs.msdn.com/b/denotation/archive/2012/11/21/installing-andconfigure-dirsync-withou-level-filtering-for-office365.aspx