It's no clear to me how you select those 100 users to receive the "restricted" message.
In case the group is formed by selecting something at installation/config time, you could subscribe those users both to the general topic and to a second restricted one.
And so on (i mean, multiple topics subscriptions).
Another option: the message is sent to everybody, but it contains a code which makes it visibile only to the intended recipients