The easiest option is to behave like a network service provider and have a single upstream account which you re-charge to your customers.
You need to match in user mode, or on remote port, if you you want to separate out two accounts from the same IP address, or, if they don’t register with you, use a single context for incoming calls, as you are doing.
If your insecure setting is correct, you cannot match on port. However it is more likely that someone has been lazy and told you to open the system more than necessary, because that is slightly more likely to work than the maximally safe setting. In most cases, if insecure is needed, it should be “insecure=invite”.