Exclude business unit from Job Requisition Security Profile?

Summary:

Our internal team has a requirement for the recruiters to view all requisitions regardless if they are on the hiring team except for requisitions in the HR business unit or for those of a certain grade code. It looks like the only way to accomplish this is via AORs, since we cannot use custom criteria.

Is there any way to simply have a "view all except" type of AOR for this, or would I need to assign the job requisition security by AOR and then assign an AOR per business unit (except HR) to each recruiter?

Similarly, if we want it to be view all except for HR and the highest grade code, would I need to assign an AOR per business unit