Import, but don't start a scan.

Craig, 

Unfortunately, we do not have the ability to set Allow Scan to disabled until after the computers have been added to the console and scanned. Additionally, with AD Sync, once a sync is initiated the added computers will be scanned by the default scan profile. 

While you are not able to do exactly as you'd like, there is a setup that will do almost the same thing you are trying to accomplish. Here are the steps you will need to take:

• Go to Preferences > Scan Profiles (or Ctrl+Comma) and click New.
• In the New Scan Profile window, click Add and choose Active Directory.
• Rename the profile if you would like and save by clicking OK.
• On the Scan Profiles page, select your new profile and click Set Default.
• On the Scan Profiles page, remove all triggers that exist for other scan profiles, particularly the Scan Age trigger on the Standard scan profile. (To do this, select the profile that has a trigger, click Edit. In the Scan Profile window, click the Triggers tab, select the individual Trigger and press Delete. Click OK and you will be returned to the Scan Profile page.) 

Following the steps above, your Scan Profiles page of Preferences should have your new scan profile set as the default and the Triggers column should be blank for all other scan profiles. It is very important that no triggers are set as this may kick off a scan automatically. Once you have ensured that you have your preferences set this way, you can set up AD Sync as follows:

• Click on Active Directory in Preferences
• Check Auto Sync Enabled 
• Select the Delete Mode that will work best in your environment. (Click on the Help icon in the product to read how each option works. If you are unsure, just choose Import Only (no delete) for now and that will work for this first sync)
• Click Include Container to browse to the containers you wish to sync and setup the exact containers you would like to have included in the sync.
• Once your containers are established as you would like, click Sync Now.

The AD Sync will add the computers to Inventory and, using the scan profile you created, will automatically scan them for only the very basic AD attributes and AD group information. With the AD Sync complete, you can now select the computers that you do not want scanned, right-click and select Allow Scan to prevent any future scanning. 

At this point, you can re-establish any triggers you deleted on the Scan Profiles page in Preferences. If you re-establish the Standard scan profile with a 7-day Scan Age, this will trigger an automatic scan of the other computers added using the AD Sync. 

Hopefully, this does what you are looking for even if it is a roundabout way to get there.