I wont lie... I dont think you can...
The allow dissallow lists don't need you to enter a 9 in the dial out fields... therefore they should have no effect on the inside dialing.
If you are going to set this up for some form of access entry phone, you might want to make the set a hotline (dials to a specific number as soon as the user picks up the handset...)
Otherwise I would suggest that you tell the customer that this is not doable (I don't understand why it is necessary) and that they might want to prevent the dialing by setting up different numbering plans for different departments ( or if two companies are using the same pbx) it is imperative to stress that if they go with this route,that they will need two blocks of DID's and won't be able to use their existing DID setup if any