Select the profile and then fixup the config the normal way.
If what the admin wants is incompatible with the profile, admin doesn't
select the profile.
Thats ugly - "distro except..." is a standard thing you ask users to do
for debugging.
However providing you separate the initial profile from the later tools
it simply becomes
make distroconfig
[cp /etc/system-kconfig(.$ARCH?) .config
make oldconfig]
make menuconfig (if you want to customise)
In addition the make oldconfig means you can ship a deliberately
incomplete distroconfig and get the user asked some bits.