One time permit install using S.E.P

If using Symantec Endpoint Protection's fingerprint feature,

If the set policy is to 'deny by default', how do you get the file's binaries so you can use a checksum to hash it and it to the fingerprint list? 

Is there a one-time permit install? 

Thanks, 

Kimberley