The only other way would be to explicitly list every single sub-ou in a custom ldap, except for the one you do not want. Yes, that's the way most people do that... assuming they have System Discover on at all. You don't "have" to have it. Not technically. If you don't push the client from the console, you don't have to discover systems in AD. You could rely on either WSUS to deploy your clients, or a GPO startup script, and then only rely on Heartbeat Discovery to keep records up to date, and forget about AD system discovery. But that's a infrastructure/design choice, and is not ideal for every environment.
Standardize. Simplify. Automate.
