To block sites with untrusted certificates without enabling SSL Forward Proxy, you can create a no-decrypt Decryption Policy rule, which ensures that traffic is not decrypted but still inspected for certain criteria (such as certificate trust). Additionally, enabling the 'Block sessions with untrusted issuers' setting will help to automatically block sessions that use untrusted certificates. These actions together create a robust approach to handling untrusted certificates without the need for SSL Forward Proxy.