In addition to 'great explanation' I'll also add that this approach seems to be very well thought out. In creating a relatively isolated 'sandbox' for BYOD use, you really do capture the best of both worlds. As you described, locking out international calling on the 'sandbox' should not affect power BYOD users (who would route via someone else) and should have little impact on 'legitimate' BYOD/softphone use. The biggest potential problem I foresee with this setup is the user who travels internationally and would want to use their service from their hotel room to call down the street. At some level, though, you have to set your limits. I think the line you've drawn is reasonable.

That being said, which server(s) is/are best for grandfathered customers to use?

Thanks...