Thank you, Matthew - we have that set. However, once the incoming call gets to vm, if they hit *, they go back out and are then rerouted (eventually) to the auto attendant extension/vm. We'd like them to have no options other than extension accepts call, vm, or hang up. I'm sure this can be done but it's not obvious to me what we are missing in our extension setup.
We currently are forcing all calls to VM to get this resolved
On the DID - we have it directed to VM in and out of office hours - that works
On User/Forwarding Rules - we have internal and external calls - forward to vm
We have "accept multiple calls, accept calls from ring groups and accept push notifications approved"
On Phone Provisioning, we left "block access to 3cx apps/webclient, hide forwarding rulies and show call recordings unchecked
On options, block remote phones using stun) is checked
Rights - can see group members and show presence to group members are the only checks