[CentOS] Selectively updating protected repos

I've been trying out the protectbase plugin for yum, and haven't yet
determined the best way to selectively update a package.  E.g. I'd
like to mark the base repo as protected, but get the latest firefox
from the centosplus repo.

What's the correct incantation for this?