Security group exclusion from a access control policy

Hi there. I raised a question some days ago and I can,t find my answer. let me clear my question again. in my scenario, I integrated IAM with the active directory, create access control policies for web access management, and then linked policies with security groups created on the active directory. I am creating a block internet policy for users who are not members of any security group. by default, IAM allows all web traffic to that user who is not a member of any security group. so I decided to create a block rule at the bottom and exclude the above security groups which are already linked with policies. by doing this, random users will be blocked.

I am facing a problem that how to exclude a user or a security group while creating a policy.