Grandstream GXP2200

Advanced Settings -> Call Features -> Disable Direct IP Calls

Grandstream GXP2130/40/60

Users have the ability to deny calls that are not authenticated. You can find the option by navigating the phone web interface, For SIP, clicking on Account X-->SIP Settings-->Security Settings and enabling "Authenticate Incoming invite"

You can also go to Account X -> SIP Settings -> Security Settings -> and enable "Accept Incoming SIP from Proxy Only"