How do I block a domain but not its subdomains (excluding www.) with uBlock Origin?

I am looking to create a network filter that blocks access to a specific domain, but not any of its subdomains. For example, blocking youtube.com without blocking music.youtube.com.

The following attempts end up blocking both sites:

||youtube.com^$document
||youtube.com$document
||youtube.com$document,domain=youtube.com

I also want to account for the optional www. in site URLs. For example, I want to block both www.youtube.com and youtube.com. So if I try adding an exception rule, it fails to catch the www. version. (Plus it could override rules from other filter lists)

! Doesn't block www.youtube.com
||youtube.com^$document
@@||*.youtube.com^$document

How can I block a domain but not it’s subdomains with uBlock Origin?