We managed to implement split tunneling with the following approach:

For Android 33+, we used builder.excludeRoute to exclude the desired IPs from the VPN. For versions below Android 33, we relied on builder.addRoute and included the required IP addresses calculated using the WireGuard AllowedIPs Calculator.