Hi,
Replying about how to restrict CLID, I think what you are looking for is the "ensure_valid_callerid" in system_config/callflow. By default it is set to false, just change it to true
you can also check the complete document here:
https://github.com/2600hz/kazoo/blob/master/applications/crossbar/priv/couchdb/schemas/system_config.callflow.json