In addition, set each class of service to FRE2, this will allow calls to in-house only but will block all external calls, including using TIE trunks. If you want the sets to receive external calls, then change the class of service to either FRE1 or just FRE, I believe one of these options will allow external calls to be received only if transfered to it from the operator. Good luck.
PS: review your restriction levels from UNR to FRE2, you will find that each restriction level will allow access to certaing outgoing trunks.