DeanG,
Have you considered placing restriction on the phone i.e. in-house calls or local calls only, or just put an analog phone with a blank dial pad programmed as a "hot-line" to an operator/security that can transfer calls? The operator/securith can remind the user of the alloted time and that the call might be monitored for security and or custmer satisfaction issues. An appearance can be placed on the operator/security to remind them that a call has exceeded a certain limit. All this might discurage the users from being on the phone too long. I know that this might be a bit too much to ask of the operator/security but I am not aware of any devices or features on the pbx that can time a call. You can be creative with ACD and music on hold but will take a bit of engineering.