You can enable or disable by device group, and the line will override the device group settings. as for a secure area, place an ip phone which does not support autoanswer. There are several options as you may see, it really depends on the enviroment.