You need your Marketo User to have restricted access to those objects and any lead without an email.
Sounds like that's not how you are setup though. When you say you have to have the Marketo User be an Admin, why? That's generally not a good practice.
Perhaps you should either remove leads w/o emails or reconfigure SFDC BEFORE you attempt to do the sync.
Maybe some of the SFDC gurus can chime in on this?
You could also sync, then use the Delete in Marketo, Keep in CRM flow step to remove Contacts and leads w/o emails.:
Delete Lead, Remove from SFDC = FALSE
Marketo won't sync those leads back until they change.