Yeah, IVR is the best way for this. You can turn Direct Dial on and setup no IVR options or you could include a single IVR option like 0 for an operator/receptionist if you want.
That said, there IS a way to filter what Extensions can be direct dialed. Create a Directory in Applications > Directory and add all the numbers you want to be accessible. If you only want to remove a few from the complete list of Extensions, use the All Users option to populate the list with everyone to start. You can also add custom dial entries to the Directory (uses the from-internal context, so be careful what you add!).
Custom entries are handy for specifying things like Queues and Ring Groups, then these can be direct dialed from the IVR too…but you might just want to add them as standard IVR entries so you can “alias” them with a different number. Example: You have a 200 Sales RG and Ext 201, 202, 203 in it. When customers call in, you want to ring the RG when they try to direct dial ANY of the Exts in it. Create IVR options 200, 201, 202, 203 and point all to the RG, then ensure those numbers are not in the Directory you are using for Direct Dial.
If you just want EVERY Extension included (but not Ring Groups, etc), then the standard Enabled selection on IVR Direct Dial is suitable. If you have no Directories created, the IVR Direct Dial option will only show Disabled and Enabled.
So, by leveraging Directory and IVR, you have a lot of control over how customers reach the inside directly.