I just drove through a bit of rain through Corona today. Was a bit of a change from the 98+ temps in Irvine.

Your vendor is partially correct. Just like like the Toshiba you can not restrict a person from dialing another valid extension on the system.

But you are also correct, with Shoretel there is very often ways to do more with the system. What you would need to do is add Extension Prefixes. If you want to can have your vendor take a look at Shoretel KB for AN10463 Deploying ShoreTel in Multi-Tenant and Hosted Environments.

Basically this adds a prefix to all extensions. For Station to Station dialing the users won't even know that the prefix exists, but they won't be able to dial outside their group (unless they know the extension prefix of the other group).

Be warned, once you go down that rabbit hole there is no going back (unless you revert to a backup). When you change the extension digits or add extension prefixes you can not go back to the original extensions.