External-to-external call transfers can be prohibited using a systemwide parameter introduced in CallManager 4.1. If this is turned on, nobody can transfer a call flagged off-net through another gateway flagged off-net. Note that in CallManager 4.1, you can choose whether any gateway port is on-net or off-net. This helps with situations where a gateway might be considered on-net, for instance, if it's interfacing with another PBX at your site instead of the PSTN. This also helps with CDR reporting and with outside vs. inside distinctive ring on IP phones.
If that setting is turned off, call transfer is only limited by the phone and directory number Calling Search Space settings. If the user's phone can call something as a normal call, it can transfer to it as well. Unfortunately, there is no equivalent of the off-net to off-net transfer restriction logic on a per-phone basis, that's a systemwide setting only as you suspected.
