Can Google services be firewall-filtered (market yes, sync no)?
To firewall, you need a root, as it modifies the iptables and filters the network stack. The iptables comes with Droidwall which is btw, an excellent tool and a must have if your ROM is rooted :)

Edit: Just checked mine, in theory its possible to create a script to modify the iptables to block the domain calendar.google.com whilst allowing play.google.com to pass through. Droidwall's set of rules are a bit too generic though, but you can most certainly set the custom script by hitting menu from within Droidwall itself and use it to suit your custom needs :) 

The IP address for calendar.google.com is 173.194.33.37. and for  play.google.com is 173.194.33.37. Sure they are the same, but you need to find out what port is the calendar using, same for play.

# Block all connections in the TCP port nn for calendar!
$IPTABLES -A "droidwall" -p TCP --destination "173.194.33.37" --destination-port nn -j "droidwall-reject"


Linky here that explains how to do add custom script.