Hi Cheli,
Here is what support said. It's a bit of a hack but it will get us what we need.
"I would recommend uploading the contacts in your report to a shared list, then making a segment containing all your contacts (Email address = *@*) and exclude that shared list. You will then be left with the contacts in your database who do not have a contact security label. "
Regards,
Greg