particle's answering of the exact reverse of your question notwithstanding, this problem is impossible to solve without at least adding in anchors.

With anchors you are able to solve it, and your second try is on the right path. What you want to do is split the problem into 252 divisions of the digits into subsets of 5 and 5, take each subset and split it into subsets of 2 and 3, then list combinations of those to get something that will match all digits in any order. Add ?s to take into account missing digits.

The main point of an exercise like this is to demonstrate that there are simple problems which REs are a very bad fit for. This is important to understand because far too often people get into the frame of mind that, "Oh, I will just use an RE for this!" and then they have two problems instead of one.

Incidentally this is very easy to solve with negative lookaheads, but that fact merely obscures the underlying point. Adding features to an RE engine extends what you can do with it, but doesn't address the fact that many tasks are just a bad fit for doing with REs.