If you don't want any external access, you could create a new tenant and put this extension in that tenancy. You then just block access to the trunks from that tenant. The one problem with this is that emergency calls are also blocked, that said, if this matters, make sure the restriction class allows emergency calls should you go down that path.