List pages to show only Whitelisted sub pages

The easiest thing to whitelist page IDs for wp_list_pages() is to use a self removing/single time running filter callback inside get_pages(), which is the function retrieving the data from either Cache or from a fresh query to the DB.

You have several options in there:

Filter the final DB result

To filter the list of returned pages, you can build yourself a quick plugin with a filter callback which you can use in your templates:

<?php
/** Plugin Name: WPSE (#165677) Whitelist pages Callback */
function wpse165677_whitelist_pages( $pages, $arguments )
{
    if ( empty( $pages ) )
        return $pages;

    // Remove instantly
    remove_filter( current_filter(), __FUNCTION__, 10 );

    // whitelist: loop through pages and build your return array of allowed pages

    return $pages;
}

Then, in your template:

add_filter( 'get_pages', 'wpse165677_whitelist_pages', 10, 2 );
wp_list_pages( [
    // your arguments
] );

This queries some unnecessary pages, but it’s a quick solution and might not hurt performance unless you have hundreds of pages.

Ignore not-whitelisted pages in the MarkUp

Simply build a custom walker that only builds subpage MarkUp for your whitelisted pages.

Pre fetch and exclude pages

You could do a query for only the ID

$wpdb->prepare(
    "SELECT id 
    FROM{$wpdb->posts} 
    WHERE {$wpdb->posts}.post_type="page" 
        AND {$wpdb->posts}.id IN (%s)",
    join( ",", [ /* IDs Array */ ] ),
);

where you then simply diff that return value against all page post type returned IDs to build a blacklist. Then return that inside a callback on the wp_list_pages_excludes, which is used to fill the exclude argument. You can use wp_parse_id_list() to make it easier to build the list.

add_filter( 'wp_list_pages_excludes', function( $blacklist )
{
    // logic to build blacklist
    return $blacklist;
}

Pass along arguments

Neither in the docBlock, nor in Codex wp_list_pages() is explained that there is no filter running on that functions arguments before they get passed to get_pages(). So the include argument works on this function as well. Keep in mind that this argument can not be used together with 'child_of', 'parent', 'exclude', 'meta_key', 'meta_value', or 'hierarchical'.

Conclusion

As often, the task you are facing can get solved using a lot of different ways. What you finally use is up to you and depends on your very specific requirements.