Hi Steve,
You can create file and folder exclusions in the Centralized Exceptions policy under Add, Security Risk Exceptions.
If you don't want your users adding/removing any exceptions, you'll want to remove the check mark next to the corresponding exception under Client Restrictions.
Hope this helps.