1. Block 900 calls thru dial plan.
(even if you can do this, the fact that outbound calls from off premises can be made is a breach you need to lock down)

Direct system inward access (DISA) parameter

2. In the system configuration within NETSET, there is a check box field to prevent giving dialtone out.