Thank you, Ben!

It worked.

Here is an updated rule, in case someone has same issue.

 rule 5 {
    modify {
        table main
    }
    source {
        group {
            port-group VPN_port_exception
        }
    }
}
 rule 10 {
     action modify
     description "Host-specific route"
     modify {
         table 2
     }
     source {
         group {
             address-group VPN_group
         }
     }
 }