From the SFDC Side, you should move those records (or delete) to a Lead Owner who cannot be seen by the Marketo User.
Perhaps you could export out of SFDC, delete them in SFDC, then import into Marketo and hold them back.
From the Marketo Side There should be two ways:
1. SFDC should reject attempts to insert records w/o Email. That's the default, so I'm not sure why that's turned off.
2. If you are a using an explicit MQL flow, you can add a filter to the smart list: Email Address IS NOT Empty
that should prevent the leads from syncing back.