In that extensions settings...
under the Options tab,make sure there is a check mark beside "Disallow use of extension outside the LAN", which is normally a default setting.
If some of the devices, the extension operates on require the tunnel (which implies they are remote), then you can't block only some devices, while giving others access. If the tunnel isn't used at all, then under the 3CXPhone tab, don't check "Use 3CX Tunnel for remote connections", again, a default setting.
This would limit the use of the extension, on all devices, to the local LAN.