Hi,
basically, dealing with this is something separate from Photon in terms of logic. It's up to you to deal with who can view/access/join rooms.
you have two ways to go about room listing:
-- you can make room invisible, and you have your own server logic ( php/mysql or else) to maintain accessible rooms based on friends listing, and your game simply get that list
-- rooms are visible to all, but your interface simply filter them, this is the same principle as what you would implement on your own server side
as for friend listing, yes, you can use facebook and graph queries. If you use your own system, you will need a lot of work to get to a point where you have your member management with all the tools to deal withs friends ( inviting, accepting, black listing, etc etc etc), so if you use a social system ready made, I strongly advice to do so, if you never tackled such system before.
bye,
Jean