I would do it with this in extensions_custom.conf:
[set-timeout]
exten => _x.,1,NoOp(Limiting maximum call duration to ${EXTEN} seconds)
exten => _x.,n,Set(TIMEOUT(absolute)=${EXTEN})
exten => _x.,n,Return
Then create a Custom Destination (with return enabled) with a dial string of:
set-timeout,240,1
In the GUI send callers to the Custom Destination before the Ring Group.