Once you have cloned the widget, you would update the 'userCanAttach' function in the 'Server script' field. Something like this: 

function userCanAttach(originalRecord) {
	if (!gs.hasRole(gs.getProperty("glide.attachment.role")))
		return false;

	//EXCLUDE A CERTAIN CATALOG ITEM
	if (originalRecord.sys_class_name == 'sc_req_item' && originalRecord.cat_item == '[the sys_id of your cat item]') {
		return false;
	}
	//END NEW CODE

	// To check whether user can upload attachments, need to check "no_attachment" table
	// attribute of the target record (e.g., incident vs. task), so fetch it if we need to.
	// GlideRecordScriptUtil.getRealRecord is not available to scoped apps, so can't use it.
	var targetRecordForAttributes = originalRecord;
	if (originalRecord.getRecordClassName() != originalRecord.getTableName()) {
		targetRecordForAttributes = new GlideRecord(originalRecord.getRecordClassName());
		targetRecordForAttributes.get(originalRecord.getUniqueValue());
	}
	return targetRecordForAttributes.getAttribute("no_attachment") != "true";
}

You would then need to update the 'ticket' page to use your cloned copy of the 'ticket_conversation' widget.