Adding Exclusions in Endpoint protection

What is the best way to add and manage exclusions in endpoint protection and how to exclude..

1- On SEPM server (as policy) for a group of clients?

2- For specific client, via endpoint client settings? (so that SEPM policy doesn't overcome this client's exclusions)

Thanks.