admin->Phones->(choose phone)->Phone Context
Change this value from "default", which allows agents to dial directly from their phones, to "jail", which does not exist. This blocks the agents from dialing directly from their phones. They must log in and dial from their agent session. Assuming you have
Users->(choose user)->Agent Call Manual
set to "1", then the agents can dial from their agent screen in the manual dial pane. But if the phone context is "jail" they can't dial unless they can log in. Then your shift restrictions are ALSO dial restrictions.
Added benefit: Everything they do is now recorded and attached to a lead instead of being completely unrestricted. You're running a call center, not a coffee shop.