Do you really want to stop people from entering these characters, or do you want to stop those characters from posting to Marketo (and therefore to SFDC)?
I don't know what fields you're planning on restricting, but I feel it violates least astonishment to stop people from typing characters that are not, in fact, always typos. In a Last Name field, apostrophes and hyphens need to be allowed, and if people add a suffix ("Jr.") in a Last Name textbox, you also need to allow spaces and periods. Companies include "E*Trade" and others with question marks and exclamation marks. If your back end can't handle these characters, maybe it's the back end that needs to be fixed? Or else you can silently strip the characters in the form's onSubmit. I think it's a better user experience to let people enter what they know to be legitimate information.
(On a related note, few things drive me as crazy as undocumented, arbitrary length limits on email fields. I'll tell you what my email address is, you don't tell me!)