Found a working solution, posting it here for anyone else hitting the same issue - trick was to redefine "resources" under the target you want to make an exception for:

bundle:
  name: hello_bundle

include:
  - resources/*.yml

targets:

  dev:
    workspace:
      host: host_name
      root_path: root_path
    mode: dev
    run_as:
      service_principal_name: DEFAULT_SP
    resources:
      jobs:
        Hello_Job:
          name: Hello_Job
          run_as:
            user_name: SECONDARY_SP/USER