Although the Service Composer will apply a policy against the security group, the default behavior of the Service Composer is applied to the distributed firewall which will be applied to all vSphere clusters that have DFW installed and enabled. Follow the steps below to change the default behavior in Service Composer:

1. Navigate to Service Composer | Security Policies.
2. Select any security policy (or create one if none exists). Click Action | Edit Policy Firewall Settings. In newer NSX (6.3.3 onwards), the Policy Firewall Settings is part of Global Settings:

3. Change the Default Applied To value to Policy's Security Group and click OK.