Have you seen the library function cleanSource() and related routines? I use these for excluding files (e.g. by filename extension) from being visible in builds. This might suit your use case too.

https://github.com/NixOS/nixpkgs/blob/master/lib/sources.nix