I would agree that creating a mapping table for ProductApplication sounds like a good approach. That is how I would probably do this.

Consider a typical query to get all products for an application. Using the mapping table it is simple.

Select [columns]

from Products p

Join ProductApplication pa on pa.ProductID = p.ProductID

where pa.ApplicationID = @ApplicationID

I think I would avoid using an exceptions table because your queries are going to be more difficult to work with. In essence going with the exceptions idea means that all of the logic has to be negative. "Get me all the products except these".

Select [column]

from Products p

left join ProductExceptions pe on pa.ProductID = p.ProductID

where p.ApplicationID = @ApplicationID

and pe.ProductID IS NULL

--OR

Select [column]

from Products p

where pa.ApplicationID = @ApplicationID

and pa.ProductID NOT IN

(

select ProductID from ProductExceptions where ApplicationID = @ApplicationID

)

Now I am trying to suggest that you should base you architecture on how easy it is to query, but in this case it makes it more difficult to code, understand and maintain. Performance is also very likely to suffer with this approach.