SEP: How to prohibit users from allowing a malware detection?

Hey guys,

Can we prohibit users from allowing a malware detection? Our Scheduled and auto protect scan action is already in 1. clean 2. Quarantine. But the status of the malware is still "application allowed(left alone)". I'm checking the exceptions policy right now but I'm hoping that someone knows how to get this right.

Thank you,