Comment 7 for bug 113622

If you don't define routes to use over the tunnel it will set a default route - all traffic will go over the tunnel.

You can't set exclusions to that - what you have to do is tell NetworkManager which networks are at the other end of your tunnel - eg 192.168.0.0/24 - then it will create a route for only that network, and not a default route.