Hiding a block from a specific role, but ONLY when paired with a second role.

Here's my case: I am using field permissions to display a paywall to anonymous users, but not to paid subscribers. This has worked fantastically while the site was so simple, and a user could not have an account without subscribing to us.

Now though, we have a new user role for users who have just purchased files from us, and have not subscribed, which is opening up a bit of a can of worms.

So new roles are:
A: Anonymous
B: Logged in (but not bought any files yet)
C: Has bought files
D: Subscribed.

I need the paywall to display to A, B, and C, but not D. This works fine.

But how do I set my permissions to NOT show the paywall when a user is BOTH C and D?

Thanks for the help! I feel like this is a logic puzzle that I'm failing at.