If I understand your use-case correctly, 'subscription-manager repo-override' can do this: 'On /this/ foo, exclude the kernel package from being updated'. a puppet module could be written to configure this.
Hi, this looks like a duplicate of bug 1178077. Do you agree? If so, I'd like to close this one and track the original.