Thanx! I had to wrap the expresion in single quotes because of the (). Also modified it to support 1-9 for the hours.

who -u | egrep ':.*([1-9]:|0:[3-5])'