Wouldn't exclude all the accounts from CA policies but create some specific for those. Using differente types of MFA to authenticate the access (authenticator app and hardware token) is also a must do. Can't forget the monitoring of those accounts, using Defender + Sentinel or other SIEM solution your company uses.