There is no option out of the box, but you can use CPL on your VCS to determine if a user can only call a particular endpoint while restricting calls to all other endpoints.
If you're running VCS X8.7 and later, you can do this from Configuration > Call Policy > Rules. You'll need a rule to allow endpoint A to call endpoint B, and a second rule to reject endpoint A from calling anything else. For the reject rule, you can use .* for the destination pattern, a regular expression that will match everything.
If you're running VCS X8.6.x and earlier, you'll need to use a CPL script, see below for an example, also take a look at the CPL Reference section of the VCS Admin Guides.
<cpl xmlns="urn:ietf:params:xml:ns:cpl" xmlns:taa="http://www.tandberg.net/cpl-extensions" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="urn:ietf:params:xml:ns:cpl cpl.xsd">
<taa:routed>
<taa:rule-switch>
<taa:rule origin="endpointA@domain" destination="endpointB@domain">
<proxy/>
</taa:rule>
<taa:rule origin="endpointA@domain" destination=".*">
<reject status="403"/>
</taa:rule>
</taa:rule-switch>
</taa:routed>
</cpl>
