replacing irule with policy

Created in the GUI, I ended up with a test policy similar to what you are describing, with no option to set "is not" on a datagroup:

ltm policy dg_check {
    draft-copy Drafts/dg_check
    last-modified 2021-03-30:02:07:31
    requires { http }
    rules {
        dg_check {
            actions {
                0 {
                    shutdown
                    client-accepted
                    connection
                }
            }
            conditions {
                0 {
                    geoip
                    client-accepted
                    country-code
                    datagroup accepted_country_codes
                }
            }
        }
    }
    status published
    strategy first-match
}

However, if you go into the command line and modify this in tmsh, it appears to work:

root@(ltm3)(cfg-sync Standalone)(Active)(/Common)(tmos)# modify ltm policy dg_check legacy rules modify { dg_check { conditions replace-all-with { 0 { geoip client-accepted country-code not datagroup accepted_country_codes } } } }
root@(ltm3)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm policy dg_check
ltm policy dg_check {
    draft-copy Drafts/dg_check
    last-modified 2021-03-30:02:09:04
    requires { http }
    rules {
        dg_check {
            actions {
                0 {
                    shutdown
                    client-accepted
                    connection
                }
            }
            conditions {
                0 {
                    geoip
                    client-accepted
                    country-code
                    not
                    datagroup accepted_country_codes
                }
            }
        }
    }
    status published
    strategy first-match
}

And then it appears in the GUI as expected (until you mess with it, then it is not recoverable there)

 I was not able to create a draft and then publish in tmsh (likely an error on my part). Using the legacy keyword I was able to work around that, but be advised my example makes immediate changes to the published policy.

I have NOT confirmed that the not keyword in the condition will function properly in this policy. If it does (please test and let me know) then this is very likely a UI bug and not a problem with functionality.