I don't know if this helps, but the instructions for Grandstream ATA's is:
To Prevent Direct IP calls to your device and only allow calls from our service please enable the following 2 options in your FXS Port Configuration Page.

Check SIP User ID for incoming INVITE - Default is No. Check the incoming SIP User ID in Request URI. If they don’t match, the call will be rejected. If this option is enabled, the device will not be able to make direct IP calls.


Allow Incoming SIP Messages from SIP Proxy Only - Default is No. Check the incoming SIP messages. If they don’t come from the SIP proxy, they will be rejected. If this option is enabled, the device will not be able to make direct IP calls.

Carl