I’m not sure any customization is needed. how about using the mod_muc_max_users module, setting it in the conference host in prosody, limiting the muc_max_occupants to 2 while whitelisting focus@auth.your-url aka jicofo ? and for authorized users use secure domain (don’t set an anonymous domain). The search function of this forum is your friend.