I'm not sure if this is still the best way, as I haven't updated in a while, but I used a URL Redirect to accomplish this.
This is the Regular Expression:
^(/dirs/|/to/|/exclude/)(.+(\.php|\.etc))
and it reports an error to the client, a 404.
This will prevent any PHP or ETC files from being delivered from those three directories.