I like the custom context method for restricting lobby phones.
[from-house-phone]
; Assuming the allowed to call extension range is 1200 - 1299
; Adjust as needed, remove the _ if you set to a specific extension i.e. 1234
exten => _12XX,1,Goto(from-internal,${EXTEN},1)
exten => 911,1,Goto(from-internal,${EXTEN},1)
exten => _[*0-9]!,1,Playback(ss-noservice)
exten => h,1,Hangup()
Then in the extension advanced settings, change the context to from-house-phone or whatever you named it.
