I think handling it this way will be the cleanest...
Look at the docs here:
Notice the beforeUpdate and beforeDelete methods state that returning false should cancel the operation.
I would start by adding a boolean flag to the RemoteKB domain model named 'protected' that is by default false. Then in your listeners (methods beforeUpdate, beforeDelete that you add to RemoteKB also) you can return false if this.protected == true. This is better and more reusable as a pattern than checking for a particular name.
You will also need to modify `upsertPackage` in PackageIngestService to create the remoteKb with the name 'LOCAL' if one doesn't already exist and make sure you set it to be 'protected'