You really don't need to bother with restriction filters in this situation, just disallow line access all together for these sets.
Give them NO access to any line pools and do not assign any lines to appear on the set.
As long as they have an intercom button, they can use it to dial extensions on the Norstar, and the auto-attendant can transfer incoming calls to the intercom button.