You can prevent callers in the AA from reaching guest extensions with Tenanting.
For example
Tenant 1: Trunks and Admin phones
Tenant 2: Guest Room Phones
Tenant 3: Vmail
In form 5, Tenant Interconnect Table
Tenant 1 is allowed to call all tenants
Tenant 2 can only call tenant 1
Tenant 3 can only call tenant 1
In form 9, assign all but the last two voice mail ports to tenant 3. Keep the last two VMail ports in tenant 1. The last two ports are reserved for wakeup calls and MWI.
In form 19, go to Tenant 3 and assign your Station Dial 0 and Priority Dial 0 Routing points. This will allow callers reaching the AA to "0 out" or if they hold on the line, they will reach the operator you designated.