I want to prevent users on an Axon network calling each other directly using IP addresses.
The only way to do this is to setup SIP Rules in the Dial Plans. You will need to create one SIP rule for every user on your network, and enter their private IP address in the "If SIP host is" field, and "Dial on line" set to "[Blocked]"
If you are in doubt about whether Axon Virtual PBX will do what you want we recommend you try the free download. Seeing the program in front of you often answers most questions