When setting up a call, Asterisk uses itself as endpoints for the media streams. However, once a SIP call has been accepted, Asterisk sends a REINVITE message to the phones so they can send streams directly to each other. By setting “canreinvite=no”, Asterisk will stop sending REINVITES after the call is established.
So, if you want to STOP the phones communicating directly with each other, just set the “canreinvite=no” in your sip.conf file.
I personally use hardwired systems using managed switches with VLAN enabled, so latency has never been a concern.
Also, just curious, how are you blocking internal communications?