You need to make the alternative extension the exact number so the number that would appear as the caller ID when ringing a normal desk phone including any outside prefix numbers. You still call the 'back door' number but if there is alternative extension identified you should just get asked for your pin.
Alternatively you could configure single number reach linking it to the mobile.
