How to make exception in password locking via pam_tally2 for specific user?

You can use the pam_succeed_if module in your stack to provide exceptions for some users. Check the pam_succeed_if(8) manpage for in-depth explanation of the syntax. An example would be:

auth [success=1 default=ignore] pam_succeed_if.so gid eq 2000
auth required                   pam_tally2.so deny=5 onerr=fail unlock_time=1200

That means, if the pam_succeed_if test returns successfully, i.e., for all users in the group whose GID is 2000, skip the following test (pam_tally2); if the test returns failure, ignore it and continue.

Several pam_succeed_if tests can be stacked up for fine-grained control.