Can I restrict what a user can see or do?

Yes. FOP2 has a sophisticated system that lets you not only define what extenions, queues, trunks, etc a user can see, but also it lets you define what actions they are allowed to perform, including the ability to restrict an action like "spy" to a subset of extensions.