Not sure what filter does - but I didn’t have to use it for my use case. Exclude does exactly what you think - list any flows you want to have excluded from the resulting dependent/referencedBy list.
For example, if you are checking dependents of test.tester:flow, and it normally returns test.tester:dep1 and test.tester:dep2, then listing test.tester:dep2 in the exclude list will mean that test.tester:dep1 will be the only dependent returned.
Ukslim has a point. However, in some cases (such as automated administration), WmRoot services can be very useful. I always make sure that anytime I use a WmRoot service, I have first checked to ensure that I can not do it another way, and that the resulting flow is both secured and located in a utility package, not in the same package as my other production code.