MitelPassion's Solution will succeed if you want to block all outbound caller ID
Again, Assuming Embedded, I would set up each of the Network features to Call by Call.
Bearer
Network Facilities
CLID
In your Modified digit strings your insert digits would then choose the call by call features.
{000} Send calls normally (brackets turn off/on SMDR)
{001} Send calls without caller ID
once this is set up you can design your ARS to go one route or the other based on user dialed access codes.
e.g. 9+ dialing sends normally
#31# + dialing sends route that blocks caller ID
If you have an NSU the theory is the same but the programming on the NSU is done thru IMAT.
*******************************************************
Occam's Razor - All things being equal, the simplest solution is the right one.