I didn't find either how to exclude a package. But I'm using the option --ignore-vuln with the vulnerability ID, which serves the same purpose.