Security Policy source-address-excluded

I'm unclear on how to exclude a single IP from a security policy (without creating a duplicate policy with reject). How do I match any IP except for one in a security policy?

Is this the correct way to get this working?:

policy my-security-policy {
  match {
    source-address any;
    source-address-excluded block-this-ip;
    destination-address endpoint1;
    application [ http https ];
  }
  then {
    accept;
    count;
  }
}