Exclude deallocated IPs that don't conform to IP policy

This method is correct, but is painfully slow for large amounts of IP addresses. I'll seek to address the performance later with a change to the IPPolicy/IPPolicyCIDR model classes.