Assuming the extensions are already assigned, and you can't put allowed extensions in a different extension range from those that aren't allowed.....
Menu for the AA, Touchtones for the transfer (ex. 1?? for 100~199). Connect to Variable Routing to match $KEY to either allowed or disallowed extension numbers, whichever list is smaller.
If by allowed extensions, route No Match to a recording and loop back to the AA, route the matches to Transfer $KEY
IF by disallowed extensions, route No Match to Transfer $KEY, route the matches back to the AA