What you are looking for is a DISA trunk with PIN authentication. Unfortunately 3CX doesn't do that. In the past I've used a SPA3102. You have to go from analogue to SIP, or vice versa. It also handles authentication via caller ID as well. They have been discontinued but can still be found.