Well,
'([^0-9\.][^0-9\.][^-])'
means "a character that isn't a digit or dot, followed by a character that isn't a digit or dot, followed by a character that isn't a hyphen".
So if you apply that to
"The policy number 21-00-00 is in section 1"
Then it will first match "The", then " po", then "lic", then "y n", then "umb", then "er " (by chance the number of characters before the 21-00-00 is a multiple of three), then " is", then " in", then " se", then "cti", then "on ". It doesn't match the final "1" so that is left in your string after the replacement (the same would be true if the final "1" were "A").
So you've definitely got the concept wrong!
I'm not sure why you don't like the analyze-string solution, but if you want to do this using replace, and if there's only one occurrence of the dd-dd-dd in your input string, then you can use
replace($in, '^.*(\d\d-\d\d-\d\d).*$', '$1')
Michael Kay
http://www.saxonica.com/
Author, XSLT Programmer's Reference and XPath 2.0 Programmer's Reference