есть необходимость разграничить доступ для разных абонентов к разным нумирациям транкам и службам

Плоди контексты

печально

хотелось бы просто создать списки запрещённых наборов и классы

а к абонентам привязать номер группы запрета или класс.

Что печально? Плодить контексты? Нет, очень удобно.
Надо запрешать отдельные списки направлений? Создайте контекст (назовите его как хотите, хоть классом), в котором перечислите закрытые направления, далее включайте его из других.
Например.

[blocked]
exten => _7903X.,1,Hangup
exten => _7926X.,1,Hangup
...

[default]
include => blocked
exten => _7XXXXXXX.,1,Dial(SIP/${EXTEN}@provider)

Чем Вам не решение?

Так и хочется что-нибудь сказать :)

Более гибко было бы хранить в AstDB или Mysql списки префиксов. Немного сложнее, но в последствии проще сопровождать.

Кракозябры правда, но и так поймешь

[routes-deny-long-distance]
;åñëè çâîíÿò ïî ìåæãîðîäó - îòðóáèòü
exten => _98[123456780].,1,Background(feature-not-avail-line)
exten => _98[123456780].,2,hangup
exten => _9078[123456780].,1,Background(feature-not-avail-line)
exten => _9078[123456780].,2,hangup

[routes-deny-mobile]
;åñëè çâîíÿò ïî ìîáèëüíîìó - îòðóáèòü
exten => _989.,1,Background(feature-not-avail-line)
exten => _989.,2,hangup
exten => _90789.,1,Background(feature-not-avail-line)
exten => _90789.,2,hangup

[routes-deny-pstn]
;åñëè çâîíÿò íà ãîðîäñêîé - îòðóáèòü
exten => _9XXXXXXX,1,Background(feature-not-avail-line)
exten => _9XXXXXXX,2,hangup

[routes-deny-local]
;åñëè çâîíÿò ëîêàëüíî - îòðóáèòü
exten => _1.,1,Background(feature-not-avail-line)
exten => _1.,2,hangup

[routes-deny-filial]
;åñëè çâîíÿò â ôèëèàë - îòðóáèòü
exten => _[2345].,1,Background(feature-not-avail-line)
exten => _[2345].,2,hangup

[routes-deny-service]
;åñëè çâîíÿò íà ñåðâèñíûé - îòðóáèòü
exten => _[6780].,1,Background(feature-not-avail-line)
exten => _[6780].,2,hangup

[group-banks]
include => routes-deny-local ;çàïðåò ëîêàëüíûx
include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
include => routes-deny-service ;çàïðåò ñåðâèñíûõ
;include => routes-deny-pstn ;çàïðåò ãîðîäà
include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-otk]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
include => routes-deny-service ;çàïðåò ñåðâèñíûõ
include => routes-deny-pstn ;çàïðåò ãîðîäà
include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-manager]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
;include => routes-deny-service ;çàïðåò ñåðâèñíûõ
;include => routes-deny-pstn ;çàïðåò ãîðîäà
include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
;include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-garantiya]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
;include => routes-deny-service ;çàïðåò ñåðâèñíûõ
include => routes-deny-pstn ;çàïðåò ãîðîäà
include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-buhg]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
;include => routes-deny-service ;çàïðåò ñåðâèñíûõ
;include => routes-deny-pstn ;çàïðåò ãîðîäà
;include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-allow-custom01]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
;include => routes-deny-service ;çàïðåò ñåðâèñíûõ
;include => routes-deny-pstn ;çàïðåò ãîðîäà
;nclude => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

[group-allow-all]
;include => routes-deny-local ;çàïðåò ëîêàëüíûx
;include => routes-deny-filial ;çàïðåò ôèëèàëüíûõ
;include => routes-deny-service ;çàïðåò ñåðâèñíûõ
;include => routes-deny-pstn ;çàïðåò ãîðîäà
;include => routes-deny-long-distance ;çàïðåò ìåæãîðîäà
;include => routes-deny-mobile ;çàïðåò ìîáèëüíûõ
include => from-internal ;ðàçðåøèòü âñå

пользователю присваиваешь, например, context=group-allow-all
если ему маршрут недоступен, то ему скажут, что "низя"