If you control the firewall and guessing you do, it would be possible to create a Policy/ Firewall Rule in most cases to allow only specific traffic from those devices to the 3CX PBX only. Only allow access to that WAN address, and ports required. So no "general" internet access but just...