Your example is wrong and can not be used as is.
Whatever. Here is a working example in 6.0:
DELETE test
PUT test/doc/1
{
  "restrictedCountry": "IN",
  "title": "ishfoo"
}
PUT test/doc/2
{
  "restrictedCountry": "FR",
  "title": "ishfoo"
}
GET test/_search
{
  "query": {
    "bool": {
      "must_not": {
        "term": {
          "restrictedCountry": "in"
        }
      },
      "must": {
        "match_phrase_prefix": {
          "title": {
            "query": "ish",
            "analyzer": "simple"
          }
        }
      }
    }
  }
}
It gives:
# DELETE test
{
  "acknowledged": true
}
# PUT test/doc/1
{
  "_index": "test",
  "_type": "doc",
  "_id": "1",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 1,
    "failed": 0
  },
  "_seq_no": 0,
  "_primary_term": 1
}
# PUT test/doc/2
{
  "_index": "test",
  "_type": "doc",
  "_id": "2",
  "_version": 1,
  "result": "created",
  "_shards": {
    "total": 2,
    "successful": 1,
    "failed": 0
  },
  "_seq_no": 0,
  "_primary_term": 1
}
# GET test/_search
{
  "took": 2,
  "timed_out": false,
  "_shards": {
    "total": 5,
    "successful": 5,
    "skipped": 0,
    "failed": 0
  },
  "hits": {
    "total": 1,
    "max_score": 0.2876821,
    "hits": [
      {
        "_index": "test",
        "_type": "doc",
        "_id": "2",
        "_score": 0.2876821,
        "_source": {
          "restrictedCountry": "FR",
          "title": "ishfoo"
        }
      }
    ]
  }
}
The thing in you last example is that you are using a term query with IN but as you can see IN has been indexed as in:
POST _analyze
{
  "analyzer": "standard", 
  "text": [ "IN" ]
}
# POST _analyze
{
  "tokens": [
    {
      "token": "in",
      "start_offset": 0,
      "end_offset": 2,
      "type": "<ALPHANUM>",
      "position": 0
    }
  ]
}