This seems like a pretty big issue and I'm sure I'm not the first to bring this up. There needs to be a much better gate between SFDC and Marketo to block non wanted leads into the system.
There isnt a real way to use SFDC profiles to pivot off lead/contact fields to stop leads from flowing into Marketo.. Marketo doesnt really provide anything to block them from coming in that I've been shown. All you can do is synch and prey your not over your contact limit (I'm over mine by 570,000 atm).
In Eloqua you are allowed to use SFDC native SOQL to block the contacts/leads from coming in. Somethign that should be extremly simply and practical for Marketo to implement as they keep saying they have a FULL SFDC integration yet lack basics like this.
I propose the dire need for a SOQL setup, or some type of integration to block leads/contacts coming in based off field values. Using SOQL or even a standard GUI type setup should easily be able to do this.
Make this happen Marketo and your customers will be so much better equiped for such common tasks as monitoring your lead database and staying within compliance.