Within 3CX I am not aware of any denial rules, though there are some Wizards here that are very good at inventing some unique solutions. A simple one I can think of would be dependent on the devices used as extensions. If they used dial plans (PAP2, Eyebeam, etc.) you could write the exclusions into the plans.