There are a couple ways to do this, without having to specify every single prefix that you're receiving from AS6400 in a prefix-list (I would personally advise against doing this because as you mentioned, the administrative overhead is high and the process will become exponentially more error-prone as the number of prefixes increases).
1) Tag routes you've received from AS6400 with the no export community. You would do this within a route-map:
route-map RECEIVE-FROM-6400 permit 5
set community no-export additive
This will tell R3 to not advertise the routes learned from AS6400 to AS1000 via the eBGP session to R1. This is your simplest option (note here that this will need to be an inbound filter applied on R4 on the eBGP session to R2/AS6400).
2) You could use an AS Path access list to determine which prefixes have an AS path that begins with 6400 and then you could use it on a BGP neighbor statement with a filter list, or you could use it in a route-map to deny advertising the prefixes on R3. This is less simple because it requires knowledge of regex (to be fair, the regex required here is somewhat simple) and it also depends on no one doing anything funny with their AS path, of which there's no real guarantee. Using a route-map, the configuration to implement would look something like this (assuming IOS):
ip as-path access-list 10 permit ^6400_[0-9]*$
route-map ANNOUNCE-TO-1000 deny 5
match as-path 10
route-map ANNOUNCE-TO-1000 permit 10
Note that the above will need to be configured as an outbound filter on R3 for the eBGP session with AS1000.
Using the well-known 'no export' community is likely going to be your best bet, along with being very judicious with your outbound announcements to AS1000 and AS6400.