How about just passing an array of datacenters to be skipped to your workflow ... SO much simpler than hacking around with permissions..
As you loop through datacenters to purge snapshots, just do a check for datacenter name/id/whatever to confirm it is not in the exclusion list before proceeding.
If my answer resolved or helped you, please mark it as Correct or Helpful to award points. Thank you!
Visit http://www.vcoteam.info & http://blogs.vmware.com/orchestrator
for vRealize Orchestrator tips and tutorials - @TechnicalValues on Twitter