How do I limit the update of the email opt out field to unsusbcribed records only??

Out of the box, the standard email opt-out field found on the contact or lead object will not be updated.  The primary sync can update this field when it runs, typically every hour.

To use this feature simply go to the general options page once there enable the very first option -
Sync Salesforce Lead/Contact 'Email Opt Out' field with Campaign Monitor.

Once enabled when the primary sync runs the field will be updated using the subscriber list membership status in Campaign Monitor.

You can make the setting more granular using the option just below - 
Only use the state 'Unsubscribed' when setting Email Opt to true.

With the secondary option enabled the email opt-out field will only be set to true if the record is unsubscribed.  If the Campaign Monitor subscriber is in a deleted state the email opt-out will not be updated. 
Related articles
How to guides
Contact Us