If they use a VoIP set or ATA with an internal dialplan, then you could block them from dialling certain numbers, but, he could just go use another extension.
I suppose that It could be done in the outbound rules, if the extension number were sent out on a loop trunk then back in, and access to that outbound rule were restricted to certain extensions, but that is getting a bit complicated.
I would think that if an employee, or employees were/was warned not to dial the CEO directly, and to go through his receptionist, yet he continued to do so, then his employment at that company should probably be "reviewed".
The managers extension number should also be appearing as a key on a receptionist set and answered by that person, who then screens and announces the call.