I had responded to a thread on the FreePBX forum about how to restrict calling without a user first logging in on a device/user mode in FreePBX.
Here’s a simple dialplan which you can then use for your implementation. For FreePBX users, put these lines of codes in /etc/asterisk/extension_custom.conf
[devcheck]
exten => *11,1,Goto(from-internal,${EXTEN},1)
exten => *12,1,Goto(from-internal,${EXTEN},1)
exten => _.,1,Set(USEREXIST=$[${DB(DEVICE/${CALLERID(num)}/user)}])
exten => _.,n,GotoIf($[${USEREXIST}=none]?endit)
exten => _.,n,Goto(from-internal,${EXTEN},1)
exten => _.,n(endit),Playback(pbx-invalid)
exten => h,1,Hangup
Reload the dialplan asterisk –rx “dialplan reload”
Put this in each extension under context settings like below for each device in FreePBX UI.

Submit and apply.
At the end that context/dialplan, play anything you like in the Playback() macro. Here, you can record stuff like “You must first log in before making any calls”. I use the above one as a simple sample.
You can put in more exceptions like emergency numbers; besides the login and logoff feature codes in FreePBX at the top.
exten => 999,1,Goto(from-internal,${EXTEN},1)
Where 999 is our Malaysian emergency number.