There have been a number of posts enquiring about limiting the ability of extensions to reach internal destinations. Which is not currently possible without a restrictive dialplan in the set.
This could be achieved if 3CX introduced Class of Service levels, as many other PBXs have had for a number of years.
Everything would initially default to 0, so all current installations would operate as they do now. As needed, a new COS could be created, then enabled per extension, limiting on what could be reached, ...extension, or ranges of extensions, Queues , ring groups, certain trunk groups (even second choice, overflow, routes only), etc.
It could also be assigned to a trunk group, to restrict IVR, direct dialling, to certain extensions.