Need Help on asterisk configuration

I have a challenge that i have been trying to solve and it has to do with preventing some Extensions from calling the PSTN. Based on my configuration i have 5 extensions (100 - 500) when calls comes in all calls are routed to exten 100 who happens to be the front desk. But it happens that 200 -500 can still call the PSTN which actually does not put a control on how calls goes out of the office. Based on this i have been trying to see away of controlling how calls go out of the office so that it is only extensions 100 that can only call how and it should also be able to transfer such calls to other extensions. Will appreciate your assistance.
Thanks

You should need 4 context’s
[incoming-calls]

[outgoing-calls]

[users] with the extensions 200-500

[front-desk] extension 100
include => outgoing-calls
include=> users

maybe the users call outside by doing an attended transfer?

it is so easy just create 4 context : one for incomming calls, other for out going alls, other for internal calls, and other context where you will include the 3 previus contexts and insert the front desk extension on this last context and the others extensions in the internal calls context

[incommings]
exten=>s,1,Dial(SIP/100)
same=>n,Hangup()

[out-going-call]

exten=>_x.,1,Dial(DAHDI/G0/${EXTEN})
same=>n,Hangup()

[internal-calls]
exten=>_1XX,1,Set(CALLERID(all)=Extension<${CALLERID(num)}>)
same=>n,Dial(SIP/${EXTEN},25,tT)
same => n,GotoIf($["${DIALSTATUS}" = “BUSY”]?busy:unavail)
same => n(unavail),VoiceMail(${EXTEN}@default,u)
same => n,Hangup()
same => n(busy),VoiceMail(${EXTEN}@default,b)
same => n,Hangup()

[front-desk]

include=>incommings
include=>out-going-calls
include=>internal-calls

Thanks for your reply and i really appreciate all your contributions to helping me solve the issue at hand. But what i am not clear of is that based on the configuration i have and based on you contributions that means some stuffs has to change in what i have and this i need clarifications on. like in my sip.conf i have the following config:

[100]
username=100
secret=100
type=friend
context=intercome
host=dynamic
disallow=all
allow=ulaw
dtmfmode=rfc2833
canreinvite=no
nat=yes

[200]
username=200
secret=200
type=friend
context=intercome
host=dynamic
disallow=all
allow=ulaw
dtmfmode=rfc2833
canreinvite=no
nat=yes

[300]
username=300
secret=300
type=friend
context=intercome
host=dynamic
disallow=all
allow=ulaw
dtmfmode=rfc2833
canreinvite=no
nat=yes
And it stops at 500

And also in my extensions.conf i have the following:

[incoming]
exten => s,1,Answer()
exten => s,2,Playback(“access-greetings”)
exten => s,3,dial(SIP/100)

[outgoing]
include => intercome
exten => _XX…,1,dial(dahdi/g1/${EXTEN})

[intercome]
include => outgoing
exten => 100,1,dial(sip/100)
exten => 200,1,dial(sip/200)
exten => 300,1,dial(sip/300)
exten => 400,1,dial(sip/400)
exten => 500,1,dial(sip/500)

This is really basic stuff. Device SIP/100 needs to be in a different context from the other SIP devices.

You currently have recursive include relations, which is never right! SIP/100 should be in outgoing and intercome should not include outgoing.

Incidentally naming SIP devices by the associated extension numbers is not current best practice because it makes it easy for an attacker to work out valid usernames to check for weak passwords.

Thanks for your reply. I am actually coming up gradually and based on my experience i think i am just 2months old in asterisk installation and configuration. I will appreciate if you could let me know the best practice and also based on the configuration i have put forward if you could please help me out on this i will appreciate.

Thanks