I would suggest modifying the canned report from
Reporting -> Windows Server Update Services Analytics -> Computer Update Status Approved Updates Not Installed
You may need to modify the report to include an aggregate count of unique updates for a count of updates that are not installed on all workstations.
Another report that may help is
Reporting -> Windows Server Update Services -> Percent Not Installed
I was able to sort that report by Total Not Installed (Percent) and the updates that were not installed floated to the top of the report.