oh, someone else is asking the same thing. I'm asking to block incoming CLI to individual stations as well. No one seems to know how to do it but Avaya seems to think there's a way but can't back it up with documentation or instructions on how that is accomplished.
I tried doing it with "cha inc tru x" and specifying call-type "public-network" on the trunk group itself and changing BN/CPN to "none" for a particular extension as instructed, but that didn't work.