6.2.6.3 EXCLUDE privilege [user|host|group|host_group|internet|project] who
The EXCLUDE line removes the specified privilege from a particular user, host, group, host_group, IP address, or project. If you specify group or host_group, it must be defined by a GROUP or HOST_GROUP line in the RLM options file.
Portions of the INTERNET address can be specified with a '*' which matches any address, e.g. 172.16.7.*
For a list of the privileges available, see the table at the beginning of this chapter.