A lookup is the way that I would suggest doing it.
I tested this and got this to work pretty easily. Here is how I did it:
Step 1: make a lookup file
I made a lookup file with two columns:
You can specify a value of "1" in the approved column to drop the destination from the search.
Step 2: update the search to use the lookup file
Next, I updated the search to use the lookup and drop the entries that match it:
| tstats `summariesonly` count from datamodel=Network_Resolution where DNS.dest_category != dns_server AND DNS.src_category != dns_server by DNS.src DNS.dest | `drop_dm_object_name("DNS")` | lookup dns_exception_list dest | search NOT approved=1
Note that the lookup I created was called "dnsexceptionlist". It drops any entries where the 'approved' column has a value of '1'.