While a wildcard might be helpful there I don't know if it would actually work. You could explore some complex javascripting in the lockdown itself to check the device for some property and then dynamically adjust the lockdown based on that context. However, I don't think its worth re-inventing the wheel when its just as easy to keep to different Lockdown Profiles and have then target different criteria. It is super easy to target Profiles by any criteria that you're looking for like OS version. Clone your existing Profile, modify the one line of the Lockdown configuration and then assign it with a filter criteria for the given OS version, then do the opposite to the other Profile. 

The conflict that comes with the multiple profiles is the innevitable issue with users that have to reset the device due to hardware conflicts that can arise or a user just doing so.

When they setup, most would not know what version they are on to appropriately scan in to the SOTI setup we have.

So though the double-profile is probably the only solution due to limitations, I would like to know more on what a script setup would be there? is it something that is running a specified file? would this be something like: file:///%sdcard%downloads/script.js ?

"script://" rather than "file://" is used to reference scrpt file.