excluding workstations from subsystem

I'm trying to find a way to exclude a workstation from entering a systems
without having to list the ones all work stations that are allowed
individually (or even by generic).  I just see having to list all the
allowed types and/or names as a possible problem down the road, especially
in a HA "role swap" environment, just to exclude one workstation.

It may be the only way to handle it, I was just wondering if there was a
clever way to do it with routing entries or anything else. I guess a simple
"exclude" parameter would be too easy.

I'm at 4.5, soon to be a 5.2 if that makes a difference.

Thanks in advance.