I have a group of trusted developers which I have given sudo permissions on a server but I want to be able to exclude some programs to be run with sudo. For example I would like to disable command `su` from being run with sudo, but to let them run it as their user.

How can I accomplish this?