How does vShield endpoint control which vms to be protected?

Hi all,

Like the title, I wonder how vshield endpoint control which vms to be protected and others not.

For example, I only have 25 licenses but there are 30 vms in my environment, and I know which 5 vms need't to be protected.

Then how can I implement it?

Thanks &Best Wishes.