Glad to have you back, @badwinter.
The first trick to realize is that one uses the match detection to “remove” matches just as much as one uses it to “add” matches.
If you are going to one.example.com, and you don’t want two.example.com on the list, it is the vault entry for two that you need to modify so that it no longer matches.
If you set them both like this, you will likely get what you want.