There is an option but this will prevent the IVR to direct dial anything in the system and you will only be able to use the IVR options.
log onto the 3CX Management console >> Settings >> Parameters>> Custom Parameters tab
Search for
IVR_DIRECT_DIALING_GRAMMAR and the default value for this should be [0-9]{3}
Change the value to
[0-9]{1}
whatever number gets dialed by the Callers while they are on the ivr the number will get parsed as single digits. That means if they dial 101, the number will be split to 1,0,1 and checked against your ivr options. If option 1 is set then it will be followed for the caller, but they wont be able to direct dial any extension queues ring groups.