what mask and/or rule to reject on Brute-Force ?

[slyexe]

To create custom mask you will apply different parameters to your command. So for example using the default mask selections you can do all lowercase + digits simply by using ?l?d and attaching it to a custom character mask by using -1 thru -4

Code:

hashcat -a 3 -m 22000 -1 ?l?d hash.hc22000 ?1?1?1?1?1?1?1?1

So to define different parameters for different positions you can always create upto 4 different custom mask.

Code:

hashcat -a -m 22000 -1 ?l?d -2 bcdfghjklmnpqrstuvwxyz?d -3 aeiou hash.hc22000 ?1?3?2?2?1?3?3?2

Sorry I also misread your question, from my knowledge there is no way to reject passwords within hashcat that do not contain a vowel. You would need to use a different piece of software and tunnel it into hashcat.

Policygen PACK would probably be your best bet for creating wordlist with specific requirements.
https://github.com/iphelix/pack