"All but" user account assignment

It would be helpful to have the option, when assigning a NMM user account a role, to assign to accounts “All but” specified accounts.

In our NMM, I would use that primarily on the majority of our MSP techs that should have access to all accounts but our internal account. Using all accounts but x would automatically provide access to new accounts while keeping the restriction in place for the internal tenant account.

Possibly implemented by separate allowed accounts and denied accounts lists.