All dial-patterns are assigned to "Partitions". A "Calling Search Space" is what determines which "partitions" will be searched for a matching pattern. To disallow outside dialing, simply build a "Calling Search Space" that does not contain the "Partition" in which the outside dial-patterns exist. Once you have built the new CSS, assign it to both the "Device" and the "Directory Number" that you want to restrict.