How to Block Internal Extensions (from calling a door lock)

Yeah, you can do this via a customer answering rule on your intercom's seat. This will require you to park the phone number associated with the seat on the Auto-Receptionist first, followed by the rule.

Under the intercom seat's Call Handling and Forwarding, click "Custom Rule" -> Add Rule. Give it a name and click "Called Number" - this is the condition used for this rule. In my example, I selected the # + extension of the seat (xxx-xxx-8800+101). Click "next" and set the rule action to something other than "forward calls," such as "Play Announcement Only." You may also need to add the main company number + extension into the rule as well, depending on how well I understood your request.

The logic here is that, with the # being parked on the AA, if someone dials into that number (or the main company number, or whatever # you input), and enters the extension of the intercom seat, the rule will match their input and route it to an announcement that says a greeting and then disconnects. This does NOT affect internal dialing of the extension, only external #s trying to open the door via a loophole. Dialing the intercom's extension as a user within your RC portal is simply them dialing the extension, not the # + extension, so the rule would not kick in and the internal RC user can still access the intercom extension. Internal users that should not have access to the intercom extension, you would just apply a custom role to their profile if you don't want them dialing the intercom to unlock doors.

This sounds more complex than it is - give it a shot and let me know how it goes. Just to be transparent, I've never done this specifically with a door lock but have done it with countless other types of hardware and/or specific client requirements for their needs and it works as intended. I presume the logic will work here, too. The only thing that might not work is if the ATA still detects the DTMF input - RC will work via the rule, but the ATA may still default to the inbound DTMF. You'll just have to give it a whirl and see.