Lock down client exclusions

Is there a way to prevent the end users from adding certain exclusions but still give them latitude to add their own exclusions. i.e. prevent the user from adding C:\ to the list of exclusions but still allow them to add exclusion for specific piece of software that's known good but triggers a fault. I don't want to have to add an exclusion every time one of the users runs into a problem but I also don't want to give them the latitude to exclude their entire C: drive.