It can be done. You just need to modify the Restriction Table (System Transfer, I think but may be wrong here) to allow 7 digits to be entered (but block numbers that say start with 0 or 1). Then in the call handler under Caller Input, enable the part that allows you to prefix a 9. Also under greetings make sure that Allow Transfers to numbers not associated to users is checked. Now the call handler that is prompting will allow the caller to enter a number, and then prefix a 9 and send to the Call Manager for transfer. Just make sure the voice mail ports on the Call Manager have a CSS that can reach the outside and it should work.
A better option would be to send the caller to the conversation "User System Transfer". This requires them to enter a mailbox number and PIN. Basically keeps random callers out and only lets employees with a mailbox through. You can also run reports on which users are doing particular transfers.
Regardless, this whole thing is just a bad idea. To risky. Just keep the whole Unity locked down and not worry about it. I'm not even sure why you would want to allow somebody from the outside to make local calls back out again. Just have them call direct.