From `man sudoers(5)`, you will find that you can use the '!' operator (remember to read its limitations).
For example, if you add the following in sudoers file:
admin ALL=/usr/bin/dnf, !/usr/bin/dnf remove
User `admin` will be able to execute all dnf commands with sudo, but `sudo dnf remove` will fail. The problem is that `sudo dnf remove emacs` will succeed.
If you change the configuration to:
admin ALL=/usr/bin/dnf, !/usr/bin/dnf remove *
Then you will have the effect you want, but `sudo dnf -y remove emacs` will remove emacs.
Changing to:
admin ALL=/usr/bin/dnf, !/usr/bin/dnf *remove*
Will prevent `dnf remove` to be executed, but it will also prevent any dnf command that has "remove" anywhere in the command line.
Most of the suggestions I found, for similar issues, include creating a wrapper script and providing access to that script.