One way I can think of is (though not exactly what you wanted):
1. Get all the Roles of the given user: appUser.appRoles()
2. Get all the Roles defined: appRole.fetchAllRoles()
Subtract 1 from 2, and you will have, all the roles that are not assigned to the given user.
Moreover, you need to have a method like appUser.fetchUnassignedRoles() to do the above.