You can create an outbound rule that is applicable to certain extensions, or all, it;s up to who you wish to restrict. If you currently had an international rule that handled 9011, as the prefix, then stripped off the 9 (access digit), before sending... you could create a rule 663865011, that then stripped off 6 digits before sending the 011xxxxxxxxxx out on the trunk. So...663865, now becomes the "PIN" that the caller has to dial before the international number.
As I said, that rule could apply to just one extension or everyone. Of course, if the old rule was still in there, you would have to set it to apply to everyone BUT the extension that had to dial the "special" prefix.
If there weren't too many, you could create a different rule for each extension, so that everyone had their own "code". If they thought they would be tracked, they would be less likely to let it slip to anyone else. You could even let them choose their own access number, but its' best to have them all start with the same digit, keeps the dial plan a bit less complicated and less risk of a conflict with an extension number.