waw74, it can be used both ways actually. AirPort Extreme has a default which is by default set to allow, meaning if you add other MAC addresses, you have the option of denying them access. In fact, when I first set my MAC filtering, I had to change the default to deny, then begin whitelisting my MAC addresses.
danatdelta, I haven't tested this out to the fullest, nor do I know the actual limitations of the AEBS, but how many addresses are you expecting to add? And would maybe creating a locked network and having a whitelist work better?