There are 2 ways to do this:
1- create 2 policies, one where the destination is the exclusion range, and one following it with the whole destination range. Enable SNAT just in the second policy. Note that policies are matched top-down so no traffic destined for the excluded range should ever hit the second policy.
2- create one policy with the exclusion range, and in the CLI add "
set dstaddr-negate enable". Now this policy will be matched by any traffic except the exclusion range. Enable SNAT on it.
Of course, you have to take care of the non-matching traffic now. So add a second policy with destination of the exclusion range and disable (rather, do not enable) SNAT in it.
This is nearly the same effort as #1 but less visible and therefore prone to misunderstandings. The 'negate' parameter is best used for more complicated cases, e.g. where you have several 'holes' in an address range and want to block traffic matching those.