We have two auto-attendants for two different departments on our Exchange server with two different dial plans. I have the scope configured to only users in the dial plan. I appears to be working for voice dialing, but when the extension is dialed, it transfers the call anyways. We want the DTMF dialing capability, but we don't want external callers to reach the wrong department.

Is this normal behavior or can certain users be completely blocked?