RLS as an exception

How would you build a role level security where they have access to everything EXCEPT something?  I want everyone to be able to see all expense categories for all cost centers EXCEPT salaries and wages, and then only see salaries and wages for certain cost centers (from a table list of these cost centers).

I found where you could filter on 1 field (cost center) based on a table of e-mails and built that.  -> CONTAINS(Permissions, Permissions[Cost Center],'CC List - 2019'[Cost Center],Permissions[Email],[Getemail]) 

This would work if I just wanted to give people access to certain cost centers, but I only want to filter those cost centers on 1 field.