One trick would be to use ChanSpy’s ‘e (exclusive)’ option, something like
exten => 007,n,ChanSpy(all,ne(${DB(AMPUSER/${CALLERID(num)}/spylist)}))
you can set the DB with
rasterisk -x 'database put AMPUSER/201 spylist SIP/202:SIP/203:SIP/204:SIP/205'