Hi DD,
As u might know in the 'Endpoint Prevent: User Cancel' response rule is for just providing awarenes or notification message to user. So it has very limited character to get user know that he doing something against the policy and need to justify.
Also refer below related thread
https://www-secure.symantec.com/connect/forums/dlp-agent-popup-customization