Is there an easy way to apply all packages but make exceptions for certain packages? A package exception list as it were? I don't see anything when clicking on the system name that would allow such an exception list.

One possibility is to clone a channel and it's assorted child channels and manually remove the exception packages from the cloned channel (pool and updates). Then, whenever it was time to upgrade the system to the latest available patches, sync the cloned channels with their origin channels and then, once again, manually remove the package exceptions. If there was a way to apply updates to these cloned channels in the same way the origins were updates, that would avoid this manual sync process which would be nice.