I need to give a user SAP_ALL without access to a few transactions, how do I do this?

The short answer is that you don't.

The purpose of SAP_ALL is to give full access (with some minor exceptions as standard). Removing a transaction from SAP_ALL will not protect a function as users will still have the access to bypass the restriction which has been put in place.

Roles should be developed to grant access to the specific transaction and authorisation values required.