Ant,
I was able to get this to work with 7821 SIP phones registering to a CME running the same version as you.
Unfortunately, with SIP phones / CME, you must manually edit the XML configuration file generated for each phone.
Within the phone's generated XML file, located in the CME flash:/its/ folder, locate the <vendorConfig> tag. Under this tag, add the following line:
<disableSpeaker>true</disableSpeaker>
Once you’ve added this, force the phone to re-pull its configuration (a manual reset typically works). I've tried this method, and it effectively disables the speakerphone.
Keep in mind that running the create profile command under voice register global will regenerate the XML files, which will overwrite any changes you've made manually. You may want to use some sort of script to apply this dynamically.
Hope that helps!