Solaris 11.4 x86 64 bit. Trying to exclude specific packages from Oracle Repository updates

We have a requirement to use custom versions of OpenSSL and BIND.  We want to be able to automatically install/update monthly or quarterly patches excluding updates to OpenSSL and BIND.  I attempted to freeze the versions, however this results in a failure for all the updates since the incorporations see DNS as a dependency.  I looked into using the pkg 'avoid' option, but this indicates it will uninstall the existing package.  The platform sees the default DNS version as the installed version, since our custom install did not have a method of updating that information.

The ideal solution would simply specify that all updates should install with the exception of <FMRI 1> <FMRI 2> etc.  I cannot find any information in the Oracle documentation on how to exclude specific packages this way.    I want to avoid re-installing our custom BIND and OpenSSL after each update.  I tested an update and it does over-write the custom install.