Thanks, Adrian. That gives me some food for thought.
We don't know what the volume will look like, so we'd like a pathway that's as simple and repeatable as possible.
So as to leave as much of the existing fusion code intact, one idea we're now looking at is duplicating the call_block dial plan and lua script, but modifying them to hard code to look up against our 'management tenant/domain' and just enter CLIs via the normal Call Block app under that tenant. We have nothing configured in the management tenant, so we can't think of anything at this stage it would cause an issue with.
The other option is writing a new app completely, but we think that's going overboard when there is already something that gets us halfway there.