Again, you need to call on your context before [ext-local] is hit. You really don’t need two contexts for this. If you match on both the dialed extension and the device’s callerID you can make sure that only 2XXX phones can’t call to 3XXX phones and vice versa. Take a look at the same code below. That one context should handle it for it.
[from-groups]
exten => _2XXX/_3XXX,1,Goto(app-blackhole,congestion,1)
exten => _3XXX/_2XXX,1,Goto(app-blackhole,congestion,1)
exten => _[*0-9]!,1,Goto(from-internal,${EXTEN},1)
exten => h,1,Hangup()