If you embed your RESTORE FILELISTONLY in an EXEC statement, you can still use your OPENROWSET approach

SELECT a.* INTO #tmp FROM OPENROWSET('SQLNCLI','Server=(local)\SQLEXPRESS;Trusted_Connection=yes',

'EXEC(''SET FMTONLY OFF RESTORE FILELISTONLY FROM DISK=''''C:\code3Billing\ClientSQLData\Master\code3billing.bak'''''')') AS a