(Based on CM3.3.3, but I don't think CM4.0 changes anything here)
Yep, create a css with only internal partions in it, then assign that css to the phone's call forward all attribute.
The problem is defining "internal" partitions. We had to change all of our route patterns to a new "exernal" partition so that the call manager can differentiate between what is internal and what is exernal.
I used BAT to roll it out to every phone in the company.
Remember to include your voicemail pilot point partition in the cs-internalonly css! Otherwise, your voicemail users won't be able to call forward always to their voicemail box.