I am not sure if you are referring to Spying via dialing a feature code, or via Sonata Switchboard.
Eitherway, Switchboard should be pretty easy to modify the permissions for a group of users. Dialing a feature code should be possible to restrict via Class of Service