replacing irule with policy

I have seen this before with IP list datagroups. As a work around try selecting "any of" from the drop down and specifying a single value (can be anything), save it. Then open this rule again to edit and you should be able to switch it to datagroup in the drop down.

This looks more like an error in the UI than a missing/feature. In my lab (15.1.2.1) I could select in datagroup from the dropdown.

I'd check the usual stuff. Different browser. If you have a BIG-IP cluster, check if the same behaviour exists on the second cluster node.

Created in the GUI, I ended up with a test policy similar to what you are describing, with no option to set "is not" on a datagroup:

ltm policy dg_check {
    draft-copy Drafts/dg_check
    last-modified 2021-03-30:02:07:31
    requires { http }
    rules {
        dg_check {
            actions {
                0 {
                    shutdown
                    client-accepted
                    connection
                }
            }
            conditions {
                0 {
                    geoip
                    client-accepted
                    country-code
                    datagroup accepted_country_codes
                }
            }
        }
    }
    status published
    strategy first-match
}

However, if you go into the command line and modify this in tmsh, it appears to work:

root@(ltm3)(cfg-sync Standalone)(Active)(/Common)(tmos)# modify ltm policy dg_check legacy rules modify { dg_check { conditions replace-all-with { 0 { geoip client-accepted country-code not datagroup accepted_country_codes } } } }
root@(ltm3)(cfg-sync Standalone)(Active)(/Common)(tmos)# list ltm policy dg_check
ltm policy dg_check {
    draft-copy Drafts/dg_check
    last-modified 2021-03-30:02:09:04
    requires { http }
    rules {
        dg_check {
            actions {
                0 {
                    shutdown
                    client-accepted
                    connection
                }
            }
            conditions {
                0 {
                    geoip
                    client-accepted
                    country-code
                    not
                    datagroup accepted_country_codes
                }
            }
        }
    }
    status published
    strategy first-match
}

And then it appears in the GUI as expected (until you mess with it, then it is not recoverable there)

 I was not able to create a draft and then publish in tmsh (likely an error on my part). Using the legacy keyword I was able to work around that, but be advised my example makes immediate changes to the published policy.

I have NOT confirmed that the not keyword in the condition will function properly in this policy. If it does (please test and let me know) then this is very likely a UI bug and not a problem with functionality.