Oh, so that's the complete opposite problem: You want to limit 10 extensions so that they can only receive calls from one specific number, blocking incoming calls from all other numbers. Is that correct?
I have set up "Management" VDNs and Vectors that check for passwords. Callers are prompted "Please enter your security code" and enter 6 to 8 digits. If the entered digits match the password, the vector proceeds. Any wrong password drops the call. This method is useful if you don't necessarily know which manager will need to call in to change a weather flag or other other item from a list.
But if you can't check the ANI in a vector then you're stuck.
Although... You could set these 10 extensions in a unique COR, 555 for example. On the COR used for the trunk, disable access to 555. No PSTN calls should be able to reach these 10 extensions at this point.
Now, set up your restricted COR 666 to have access to 555 and use EC500 to assign your allowed PSTN number to a station with that COR. I *THINK* this will stop all incoming PSTN calls from reaching these 10 extensions but will allow the one specific PSTN number.
I'm not confident in that method but it may be worth a little experimentation.