You could by using the internal dialplan of the set, depending on the model. You could then restrict digit patterns and block before being set to 3CX. Other than that, all dial restrictions, are based on outbound rules, not internal calls.
You could write a service that monitors all calls (using the 3CX Call Control API) and if you see a call initiated between two extensions that are not permitted to call one another, drop the call.