Restrict a Group of Extension in one step

[MylZhI]

I have a bank of 6 stations that need to be locked and unlocked throughout the day. The specific times vary from day to day. Today, there is a "control" station which has station lock\unlock keys assigned for each of the 6 stations (12 buttons total). With several more systems coming on line, each with similar lock\unlock needs, this solution will not scale well. We are considering configuring group control restriction activate\deactivate buttons on the control station, and assigning a special restrict cor to the 6 + stations. There is concern however that it does not take too much to discover the activate\deactivate string and curious hands might start substituting COR values. Is there any way to exclude specific CORs from being selected once the GCR activate\deactivate FAC's are known? Are there better ways to make this happen?