This is really a decision that your company needs to make. The GDPR says that both consent have to be given, but it does not say that they have to be given separately, only that they have to be well informed. Most of my customers here in France are combining the 2 in one opt-in.
The problem IMHO, is elsewhere : if the person does not give the combined consent, you are not supposed to keep them in Marketo. You are not even supposed to let them enter Marketo, in all rigorousness. So the minimum would be to anonymize them and, if you really want to be 100% compliant, to erase them, as for the moment anonymization cannot be total. See GDPR and Privacy: "anonymize person" flow step