The issue is, I don't know any private key bruteforcing tool that does that so you might have to search for one yourself of find someone to code it for you.
The feature to limit search space when recovering Base58 inputs was added to FinderOuter in version 0.15.0.
That's great news for OP.
However, I can't seem to find an option limit the search space of each specific position; the feature seem to affect all of the MissingChar symbol.