Restrict all traffic with exception

[bgomberg]

I have a couple OS6850 stacks that are operating as core routers as well. I have several subnets on the network. There are static routes in the config to a protected system. I would like to restrict access to either the route or to the next hop device (10.0.4.254) via an access list of some kind. All of the VLANs should be able to access all devices and routes in all other VLAN's with the exception of the example below. Ideally I would be able to restrict access via IP or MAC so that only specific systems can access the next hop. This would be my first time doing it on an alcatel system. Can this be done on a 6850 and what is the preferred method? I would prefer to not need a RADIUS if possible. Please see below for details:

Subnets:

10.0.3.0 VLAN3 (NO ACCESS TO ROUTE)
10.0.4.0 VLAN4 (FULL ACCESS TO ROUTE)
10.0.5.0 VLAN5 (NO ACCESS TO ROUTE)
10.0.6.0 VLAN6 (NO ACCESS TO ROUTE)
10.0.7.0 VLAN7 (NO ACCESS TO ROUTE)

Static Route Example in question:

ip static-route 111.11.11.11/32 gateway 10.0.4.254 metric 1