Not sure about “the best way of handling this”, but one approach we sometimes use, is to install the RPM that adds some repo file, and then clearing said repo file (replacing the entire content with something like):
# This yum repository needs to be empty so that only Foreman supplied repos are used!
Seperately we make sure the required repo is available on Foreman.
This comment also looks like it might be relevant: One-off repos on systems when subscription-manager is in use? - #2 by Dirk