I see a little bit of confusion in this post, let’s try to clear some points 
- Latest nethserver-pulledpork doesn’t brake anything, it just uses new optimized rule format for Suricata 4.0
- When implementing an IPS/IDS on your network you must tune the configuration and block only relevant categories
- Rules are automatically updated overnight and could change their own behavior
We didn’t experimented any issue so far, this is our current production configuration for Suricata:
suricata=service
AlertCategories=ET-emerging-current_events,ET-emerging-dos,ET-emerging-ftp,ET-emerging-games,ET-emerging-inappropriate,ET-emerging-info,ET-emerging-misc,ET-emerging-mobile_malware,ET-emerging-p2p,ET-emerging-scan,ET-emerging-shellcode,ET-emerging-sql,ET-emerging-trojan,ET-emerging-voip,ET-emerging-web_client,ET-emerging-worm
BlockCategories=ET-botcc.portgrouped,ET-botcc,ET-ciarmy,ET-compromised,ET-drop,ET-dshield,ET-emerging-activex,ET-emerging-attack_response,ET-emerging-exploit,ET-emerging-malware,ET-emerging-netbios
status=enabled
Yes, you can use yum downgrade but it will have no effect on your problems.
We could find a way but it’s quite difficult at firewall level because you need to bypass also established connections.
If you want to add exceptions, the simplest way is to hack the Suricata rules. 
The traffic between LAN hosts doesn’t flow through the gateway, therefore it can’t be affected.