AnyConnect Tunnell-ALL except for xx.xx.xx.xx

Have a use case where I need to tunnel-all traffic through the RA VPN except for some specific CIDRs. Has anyone done this and if so can you share your config? I can't use split-tunnel with exceptions for the traffic that needs to be tunneled because it changes often and is tied to our offices source IP. Wondering if using Tunnel-ALL allows for a deny or permit to route that traffic locally via the client?

Thanks