Hi,
I am afraid there is no direct way to exclude some special grants from a role.
You can build the interval around the unwished values.
For example:
S_TABU_DIS Activity=02;Authorization Group = 0* - 9*
A* - XX31
XX33 - ZZZZ
This will excude Authorization Group XX32.
Thanks
Jim