There are a lot of ways to restrict 900 access so to answer your question we'd need a lot more detail.
In general, you assign a route to the 900 calls that has a unique COR and then you assign a COR to the allowed phones that allow them to dial 900 numbers as well as any other allowed number.
This isn't something I would normally suggest someone try to do unless they are very familiar with ARS.
Or,
Specifically restrict 900 access for all COR and then program speed dial numbers with toll overide to the specific 900 numbers you need to allow. This maintains your restrictions but allows anyone access to 900 numbers you need to call.
Ralph
