Hey Stephan,
To expand on what Josh said:
To prevent leads from syncing down into Marketo from SFDC, we suggest to set up sharing rules in SFDC. These rules could be set up on a field called "Hide from Marketo". When hide from Marketo is set to true, the Marketo sync user will not be able to see these records and thus not be able to sync them.
Will