I'm definitely not an expert on options contracts, but the examples of clauses I've seen are:

(In the options exercise agreement): "All certificates evidencing shares purchased under this agreement shall bear the following legend: "The shares represented hereby may not be sold, assigned, ..., except in compliance with the terms of a written agreement between the company and the registered holder...""

(On the share certificate): "This certificate and the shares represented hereby are issued and shall be held subject to all ... bylaws of the corporation, to all of which each holder ... agrees to be bound"

Either of which seems to give the company the ability to unilaterally reject any transfer/sale of shares.

There are reasons to do this also, as the number of shareholders can trigger reporting requirements even if you are private (jurisdiction dependent, of course).

In my opinion selling within the existing pool shouldn't be restricted, but this could become a sticky issue around board control so that probably contributes to the desire to control/curtail it.