Call restriction feature is planned for a future release.
There is a workaround available for current release. If you configure the system as Key System (instead of blend or PBX), you can place a phone without keys (i.e. SPA301 or SPA502) in a public area. These phones will get an extension but will not be able to dial out as they dont have trunk keys.