How do you remove certain mailboxes from the All Users Dynamic Distribution Group?

Rules for DDG membership are indeed based on attributes, so you cannot just "point" to a given mailbox. An easy solution is to populate one of the customattributeXX values and use this as exception. You can create a more complex rules via PowerShell and the Set-DynamicDistributionGroup cmdlet, such as excluding certain mailboxes by Name, DisplayName, GivenName, whatever other attribute you can think of...