I'm not sure if this is really the best approach (I'm a newbie), but I've done two things to try to prevent this:
1. Set up a nightly flow to change all employee's lead score to 0 (based on domain). They are now excluded from any campaigns or flows triggered off of score.
2. Set up a global suppression list (unsubscribes, email invalids, etc.) and included employees in that list. I then point to that list (using the Not In Smart List filter) whenever I set up a flow.