Partitions and calling search spaces are definately what you want to use to implement the restrictions you want.
The thing to remember is that the calling party can only reach DNs contained in partitions listed in their calling search space.
There is a device and a line calling search space, and it is the combination of these two calling search spaces that create the PSS (phone's search space). Order is important for matches and the line's calling search space takes precedence.
Also, by default, the partition is searched by all calling search spaces and can not be excluded. You would have to use specific blocked route patterns to prevent calling to DNs in the partition.
Finally, you will have to restart the calling search space and phones from Call Manager after you make the changes so they take effect.
Let us know how it goes.
