Hi Wendy,
There are quite a few threads on this. The best way seems to be to restrict the records and data your SFDC Marketo User can see. It's not always custom work in SFDC.
If you did not want Marketo to push leads to SFDC, that's easy - just make sure your master sync campaign has specific MQL criteria before syncing to SFDC. Of course with the Programs linked to SFDC Campaigns, you'll find more leads syncing over. You can control this by setting up SFDC Lead Queues and setting the Auto Assignment rules to push leads into holding pens where Sales won't see them.