I figured this out. It looks like the only place that the sql code exists for looking up products to show is in index.php. I modified all the SQL code so it hid products based on my criteria. For instance, if a user has purchased a particular item (like a membership to our site) then I allow another couple of products to be visible for purchase.
I was worried about looking in the cart and having to figure out all the places I would need to change it, but it turned out to be not that bad.