Don't use any of the SFDC-specific flow steps (sync lead, change owner, add task, add to SFDC campaign) and don't use Program-Campaign sync.
If you're really serious about blocking leads from SFDC, create a custom checkbox in SFDC and create a validation rule in SFDC so that the checkbox needs to be checked when Marketo creates a Lead. That way, you need to explicity check that box in Marketo before you sync, so it's a lot less likely that you'd accidentally sync the wrong leads.