it all depends on how you want to implement (how complex your requirements are).
Outbound rule are able to be "customized" to apply to one. or more extensions only, which means that in place of dialling 91XXX-XXX-XXXX, you could require 23354-91-XXX-XXX-XXXX, then strip off the unneeded digits. Without the 23354, you have to be sure that there is no other outbound rule that will permit the call to complete. It just depend on how may passwords you wish to implement and how often you wish to change them.