Place that one CO into it's own co trunk group. Under the trunk group programming make sure only his extension has outgoing and answer access to that Trunk group. Not sure if reverse transfer overides that or not.