I don't think it's going to happen. You can forward to any number you can dial...if you restrict LD it will apply to both numbers you call and numbers you want to forward to.
If you're concerned about specific numbers or specific types of numbers (Bob's cell, Puerto Rico, etc.) you could put those numbers in the DENIED list of COS.
Since your concern is CONFIG ASST, if you don't have too many people you could restrict who can call the CA: build a new call routing table keyed on OUTSIDE PARTY NUMBER. Build a list of the likely suspects (our cell numbers) and set destination to CA, then "+" numbers go to a dead destination (empty port, missing phone). Pick a DID and route it to the new table. If you don't want to dedicate a DID, route all calls to new table BEFORE going to DID table. Then known numbers go to table that goes to auto att that includes "press X for CA", all others go to table that doesn't allow this option. BTW, don't need to duplicate the whole table, just the DID that goes to auto attendant.