Not without some work. The system itself treats all user extensions as peer, meaning that all are equal and can dial one another.
The only way that I can think of is to modify the dial plan in each phone that is not allowed to dial the CEO and simply disallow the extension number to be dialed or, if possible, to substitute his number with that of one of the PAs. The easier way to do this is, assuming the use of supported phones, if to use the templates and make one for the population at large and another for the PAs and modify the dial plans in these and then re-provision the phones.
An odd request, sadly no........... and not speaking about the 3CX aspect of it.