Link a GPO to an OU or security group, Who will win?

As long as your GPO is not linked to any OU it will not have any effect.

In your case you could do the following:

Link both, Disabling-GPO and Enabling-GPO, to the same OU. In Delegation of Enabling-GPO Allow rad/apply to for example, Authenticated users. In Delegation of Disbaling-GPO Allow read/apply only to your Security Group. Watch for Link Order as Disabling-GPO needs to have the lower number (Prescendence).

What happens with this for Member of the Security Group: Enabling-GPO will be applied first and afterwards Disabling-GPO, leaving the Setting disabled.

If your Setting is for example a registry key in Preferences you could also use a Item-Level trageting by Security Group