The easiest way to achieve this is to simply set up a message moderated list, and add all the e-mail addresses to the moderator db. Use a custom location, if you want a different set of moderators for subscription moderation/remote admin. If a "moderator" posts, only s/he will get a confirmation request. If anybody else posts, the post will be sent to all moderators.
To directly bounce posts from SENDERs not in the database, use the ezmlm-store -P (not public) switch. This is more secure than a simple ezmlm-issubn(1) construct, since faking SENDER to a moderator address will result in a confirmation request to that moderator (which s/he will reject/ignore), rather than a direct post. The draw-back is that each post has to be confirmed, but with the speed of ezmlm the request will arrive immediately after the post is made, so the overhead should is The best choice depends on your particular needs in the trade-off between security and convenience.
‘ezmlm-make -om’ will set up such a moderated list with ‘ezmlm-store -P’. This is the most useful setup for an announcement list.
Setting a list up in this way with only the owner's address gives you a pretty safe owner-only list.