What you will need to do is create a network list defining the traffic you want encrypted:
Configuration | Policy Management | Traffic Management | Network Lists - click on Add.
Once you create the network list, go to the group configuration and enable split-tunneling feature
and specify the network list that you just created.
Configuration | User Management | Groups | Modify client (mode config tab).
