How to block calls from an extension?

You need to set up a class-of-service that allows only internal calling and apply it to the relevant extensions.
The simplest way to do it is by creating a class of service with Route Selection = None.
This way the extension will not be allowed to use any route and will be able to only make internal calls.
Under Class of Service you may also configure which features the extension may or may not use and some other restrictions.