SSL-VPN, exclude specific login address

Specifically to your question - how to exclude/re-assign specific IP address from its GEO allocated country - it is not possible (at least 7.0.x, 7.2.x) . 

But in the context of what you are trying to do - you can move SSL VPN to listen on a Loopback interface, in which case you will have Security Rules as additional measure of control, then you could block these specific IPs in a rule above your GEO-allowing rule. 

I already have a geographic address defined in the SSL parameter. This makes a filter, but I want to filter a range of addresses that are in the geographic area and I can't do it.
It's a fortinet 60E

Create a local-in policy to block set of IP ranges.

You might find this KB as a better solution but keep in mind that a legitimate user might get blocked as well thus you need to manually remove the false positive public IP address from the group.
 How to permanently block SSL VPN failed l... - Fortinet Community

I do like this post, but I can't mixed accept only IP address of my contry and deny for this group.

I can only Accept my contry or only deny a group of IP.

I create a firewall policy with action as DENY and source as my group, but I have always login failed about some IP address of this group.

Hello,
You can create a local in policy to restrict from specific IPs, refer below document for your reference
https://docs.fortinet.com/document/fortigate/7.6.1/administration-guide/363127/local-in-policy

Thanks,

Pavan