What you can exclude, and where
You can exclude individual URLs, whole sites, mobile apps, entire app categories (games, dating, kids), YouTube channels, and videos. For most campaign types you set these at the campaign level. For Performance Max, campaign-level exclusions are not available, so they must be applied at the account or manager-account (MCC) level, which PMax then respects.
The two-layer habit
Category exclusions through content suitability knock out the obviously off-ICP inventory up front. The ongoing work is the placement report ("Where ads showed"): review it regularly and exclude the specific apps and sites that actually served junk. Placements never stop appearing, so it is recurring hygiene, not a one-time setting. Placement exclusions are the where-ads-show cousin of negative keywords; full walkthrough in the PMax mobile-app leak.