Incoming calls land directly to operator's extension (or through an AA)? Which partition do operator and other extensions belong to? What is your "entry" to your CUCM; a SIP trunk?

Check the CSS next to the Call Forward All Destination at DN configuration page.

You can place the DN of the requested phone to a new (unused) partition. That way, no one will have access to the DN (since that partition will not be present in any Calling Search Space) and the user will be able to place outgoing calls, according t...