I may not be understanding your requirement completely, likely due to my unfamiliarity with the config file in question. Here is what I think you are trying to figure out, please let me know if I am wrong.
By default 'device-group' should have 'pre-rulebase'
There are exceptions to that rule
These are each single config lines
Alright so assuming I have gotten the basics down this may work, if not can you provide a sanitized example of the config you need to exclude and that which needs to be checked.
You can close the ticket, I found out how to do this.
Sr. Network Engineer
Eze Castle Integration, Inc.
529 5th Avenue, 7th Floor
New York, NY 10017
Support Desk 212.954.0660
Can you share your findings so that others might benefit in the future?