When deploying DBeaver-CE to endpoints via InTune, is there a way to safeguard against Windows Defender monitoring exception?

[olspookishmagus]

When deploying DBeaver-CE is there a way to disable the Windows Defender monitoring exception prompt and also disable this option from being available activated by a user who gets DBeaver-CE deployed to him/her/it?

Searching issues got me to an option mentioned, namely: "windows.defender.startup.check.skip=true" found here:
#36187 (comment)

Without being sure about whether this is the place where that option should be, but I'm not seeing it getting mentioned here as well:
https://github.com/dbeaver/dbeaver/wiki/Windows-Silent-Install
or here:
https://dbeaver.com/docs/dbeaver/Admin-Preference-Restrictions/

So in retrospect, is there a way to safeguard against being able to except this application from Windows Defender monitoring to a user who gets DBeaver deployed to him/her/it via Microsoft InTune?