Need CHANSpy enabled on only three extensions

I am trying to enable CHANSpy for only three extensions. I want these three to be the only extensions that can be listened in on. I have been able to password protect the feature, but I can’t seem to block access to other extensions. I have tried following a few tutorials with no luck. Thanks for any help!

The g(group) option with some dial plan logic could do the job
Only spy on channels that contain a channel variable named SPYGROUP, which should contain group in an optional colon-delimited list.