There are probably lots of different ways you could do this. Obviously, the first line of defence is the PIN number, but you could alter the regex in the condition to prevent it matching an extension. For example if you never want extensions 201 or 203 to be eavesdropped then add a negative look ahead ((?!...)) to the eavesdrop condition in the dialplan manager:
^\*33(?!201|203)(\d{2,7})$