DO NOT DO THIS UNLESS YOU KNOW EXACTLY WHAT YOU ARE DOING AND EXACTLY WHAT THE RESULT WILL BE.  
Please see "weaknesses" at the end.
This added after some rather strong opinion by folks in #gentoo.
Additionally, recent changes for Xorg resulted in a massive increase in dependancies for a basic Xorg installation.  Even one with absolutely everything disabled.
Why, I do not know. Stupid I guess.
In my case, this meant dropping the exclude and regenerating afterwards.

For tightly controlled servers or laptops, you may not want all the portage tree.
Even if you are running a local rsync repository, it takes up a lot of disk space, and even though
former cpickle issues have been resolved, takes a lot of time.
And if you *aren't* running a local repository, it wastes mirror bandwidth.

By request, I'm adding the note that for this to work, you need to add:
RSYNC_EXCLUDEFROM=/etc/portage/sync.exclude
(PORTAGE_RSYNC_EXTRA_OPTS="--exclude-from=/etc/portage/sync.excludes" in portage 2.1 where the cpickle stuff was resolved)
to make.conf.  A little more detail on this can be found on the Gentoo Wiki.
It uses esearch 'cause I've used it for years.
eix seems to do the same thing in the same amount of time.
With this, on one server which runs a few basic services like routing, ssh, and a very minimal x11 (and a few other toys)
the total size of /usr/portage is 37M (excluding distfiles which is, of course, an NFS mount).
emerge sync is virtually instantaneous.

The extreme approach.
	esearch -o "%c\n" ^ | uniq > /tmp/all.directories
	esearch -I -o "%c\n" ^ | uniq > /tmp/install.directories

Then do a quick n dirty diff in some fashion.
	cat /tmp/all.directories | while read f;do grep -q $f /tmp/install.directories;if [ "$?" -ne "0" ];then echo $f;fi;done > /etc/portage/sync.exclude

That'd be the initial exclude.  All directories you don't care about.
Next.

	k=$(head -n1 /tmp/install.directories);esearch -I -o "%p\n" ^  | grep -v virtual | while read f;do j=$(echo $f | sed 's/\/.*//');if [ "$j" != "$k" ];then echo "${k}/**";k=$j;fi;echo "+ ${f}**";done >> /etc/portage/sync.exclude;k=$(tail -n1 /tmp/install.directories);echo "${k}/**" >> /etc/portage/sync.exclude

This one-liner requires providing as k the first directory in which you have a package installed (yes, I'm lazy - that could have been done with an extra while loop condition) and append to whatever you called the exclude file in /etc/portage (or wherever you put your exclude file).
That adds an exclusion pattern on the rest of portage.

Finally, blow away all the package directories and test it.
	cd /usr/portage
	cat /tmp/all.directories | xargs rm -rf 
	rm -rf metadata

Then do an emerge sync.
Then do an emerge -auvD world or whatever your preferred syntax is.

[Weaknesses]
Obviously package searches are out of the question on this machine - it'll only know about packages in your tiny repository.
I've discovered from time to time portage adds a dependancy that I didn't previously have, so an update fails.
This seems to only happen with the -D/--deep option to emerge.
Or of course, a package in a new version may have an extra feature you may want.  Or a package slot was moved (rare).
Or there may be a new package you want to add to the system.
In those cases you'll have to edit your sync.exclude by hand, add a line of the form:
+ category-name/package-name**
above the category-name in the exclude file.
Then resync your system.

Another issue folks may encounter is with the Xorg reorg, which was rather massive.  In that case, probably easiest to allow all x11 directories, and optionally mask more specifically later once you have a better idea what you want in your xorg.

Oh, and finally, portage may create new directories.  If this bugs you, you can add those directories to the exclude, as well.