The router pattern attached to a calling serch space is used
and if its not allowed internaltional calls, it applied to all phones
that is configured with the calling serch space.
The other option is to add a single digit translation and time any phone hits 0, you get routed to a port
on a gatway configured for IVR and this can then allow any calls for
authenticated clients.