You can use groups to filter out buttons. Are you configuring things by hand or via freepbx?

This is an extract from fop2.cfg

; --- SAMPLE GROUPS ---
; group=queues:QUEUE/100,QUEUE/101
; group=deptA:SIP/100,SIP/101,SIP/102
; --- END SAMPLE ---

; --- SAMPLE USER LIST ---
; format: user= EXTENSION : SECRET : PERMISSIONS : GROUPS
; You can enumerate several permissions and groups separated by comma 
; available permissions:  'all', 'dial', 'hangup', 'meetme', 'pickup', 
;                         'record', 'spy', 'transfer', 'whisper', 
;                         'queuemanager', 'queueagent', 'phonebook',
;                         'chat', 'preferences', 'hangupself',
;                         'recordself', 'voicemailadmin'
;
; user=620:1234:all:queues
; user=621:1234:dial,transfer,pickup:deptA

In the above example, user 620 will see buttons listed in group "queues" (only queue/100 and queue/101), while user 621 will see only buttons listed in group "deptA" (SIP/100,SIP/101,SIP/102)

So, you can create a group with the exact buttons you want some user to see and then add that group as 4th parameter in the user line.

yes, you can do that , but you have to enumerate all sip peers in the first group.

Ouch, that's what I thought. I have it enumerated in my development environment, and that worked, but it's definitely ugly.

Is that going to cause any kind of slowness? We have a possibility of any extension between 3000 and 4999 and I'd rather not add each one manually because that can lead to mistakes and omissions.

As an aside, how would I make it so that user 1000 can only listen/whisper to their queue, but can still see all users?

That is why you can use scripts to generate config files. The FreePBX managment module for example creates groups named "All Extensions", "All Queues", etc, automatically. You are free to write your own scripts and use #exec instead of writing the configuration line by line.

Appart for groups, you can define permissions, to limit an action to certain buttons. For example, in fop2.cfg

perm=spysales:spy:SIP/1009,SIP/1001

And then:

user=1000:password:spysales,hangupself,transfer,transferexternal,preferences:some-group

You assigned a 'spysales" permission that is the regular "spy" but limited to SIP/1009 and SIP/1001