The "no-pathing-zone" thread got me thinking about this; this alternative seems much simpler to implement and more logical.
Basically, we just need a zone of some sort that the player can designate, within which no jobs are generated -- just treat all objects and structures within as forbidden, and prevent jobs for a target inside that area from entering the job queue. I think this is how 'dwarves stay indoors' works? This would be akin to forbidding everything in the area, but it would also cover everything new in it, without requiring constant monitoring on the player's part. Perhaps it could also be easily turned off / on somehow.
An alternative / additional option would be to have a 'treat area as indoors' zone... well, that name isn't so clear. But the point is, a zone that counts as indoors for the purpose of the 'dwarves stay indoors' restriction, allowing dwarves to take jobs from that area even when 'dwarves stay indoors' is on, so, say, a well-protected outdoor farm can be made accessible while forbidding everything else.
This would only cover civilian jobs, so soldiers could still be ordered in there.
Of course, dwarves might still path through the 'forbidden' area -- but this is far, far easier for players to avoid with existing capabilities. Dwarves and pets might also randomly wander in, but the chance of that is much lower.