The events will be generated regardless as they are received and read from the logs, but you can use rules to determine when events might fire an email or notification. There isn't really a way to suppress events from being received or shown entirely on the LEM side, but you can use LEM to only "escalate" useful information to you when it passes your threshold.
For example, if you're getting a ton of Web Traffic but want to maybe see a different type of event when it exceeds your threshold, you can create a NEW rule that does something like:
WebTrafficAudit.EventInfo = *denied*
Threshold: 150 in 5 seconds
This would tell you if you saw more than 150 WebTrafficAudit events that contained the word "denied" within the last 5 seconds.
You might consider an advanced threshold for Same SourceMachine so you know when the same system on your network generates them, not just when suddenly a bunch of random people are getting to them.
Does that make sense?