Hi Sara!
We had a similar issue. You are on the right track; the crux of all the solutions we found were in limiting the permissions of your "Sync User" so it can only interact with the records you want on Marketo. I am surprised that the sharing option didn't work out. Was the problem with the logics of sharing that many records (stupid POA table) or did the user fail to sync the records? Just to clarify, did the user have read/write permissions or read only and did you modify the Marketo Sync User security role or create a new one?
I don't know the details of your business requirements, but our case was admittedly pretty simple. We have a lot of records going back to 2001 that we wanted to keep in CRM, but did not want on (or near) our active marketing lists. We tried a few things, but we eventually created a new business unit, "Legacy Records," with a single user ,"Legacy User". We limited all the permissions on the Marketo Sync User role so it could only see records on its own BU and assigned all our old records to the Legacy User. Since our sync user was on our main BU, poof, all the old records were invisible to it.
Admittedly, this doesn't work if you have multiple business units or if ownership matters on the records you're trying to hide. One option could be to limit the sync user to only records it owns then create set of teams for each of your users with the sync user. If the user wants the lead in Marketo they choose the "User Name - Sync to Marketo" team as the owner otherwise they pick themselves. Probably not practical, but possible.
I do like the idea of creating a "Sync to Marketo" field, but modifying the plugin was not an option we were able to explore. Please let me know how that works out if you pursue it.
Finally, if its not a matter of space in Marketo but just "Leads we market to" vs. "Leads we don't market to", you can create the "Sync to Marketo" field as you mensioned and set up an operational program in Marketo to set all leads with "Sync to Marketo" = "No" as "Marketing Suspended" = "Yes" and add them to a "Do Not Use" or "Global Exclusion" segment. Then just train your marketer to tack a condition that the records are not in the "Do Not Use" segment to all of their smart lists.
I hope this was at least somewhat helpful. Let us know how it goes!
Zach