Jamie, you can set up Criteria-based sharing rules in salesforce that prevent Marketo from accessing records that don't have an email address. This requires that your organization wide default is private for Leads and Contacts. See below for an example of such a sharing rule. If you're not familiar with salesforce administration, please talk to your administrator.