Branching a call based on a condition is done using the Dynamic Routes module. If you set up the AllowList module, you can use a dynroutes “Asterisk Variable” query that looks like this
$[${DB_EXISTS(allowlist/${CALLERID(number)})}]
The above expression will return a 1 if the callers CID number is in the AllowList database, otherwise it will return a 0. You can then set the destination for each condition using 0 and 1, like this:
As far as challenging callers for a PIN, you can do that with a standard IVR if everyone has the same PIN, otherwise you can also use dynroutes to check the caller provided PIN against an API using an API lookiup.