I think you shuld give each tech a 2nd dn similar to the original one. Say your external number plan is 12000-12999
Say Tech1 has 12011 as his personal DN, assign KEY 0 as 88011 and KEY 1 as 12011. i.e leave only 3 last digits.
That way incoming external calls cant call KEY 0 (88011) and for internal calls, just add DENY 88 in NCOS table.
Use Key1 for personal calls. Use Key0 for Tech's cases. Set NAME for all 88xxx extensions as "Techsupport"
They culd still call tech1 on key1 but most workers wont realise that pattern and tech1 can just ignore incoming call on Key1 if he see's its from some one who shuldent contact him.