Yes, that room join check must go the Zone-Level extension, so you can check for every room.
And yes, send a custom ExtensionRequest from the client (with command like "joinRoom") and then on the Zone-level extension you check if the user is permitted or not to enter that room. If he is, you join him using also the extension, this way you have more control over the situation and don't give much freedom to the client.
SFS Pro/Basic, SFS2X, AS2.0/AS3.0, Java, HTML5/CSS3/JSSFS Tutorials: http://sfs-tutor.blogspot.com/
- I no longer update it nor visit it. Some examples may be bugged.
If I take too long to reply, feel free to PM me