I designed a technical solution to this last year and ran it as a business called CallStop for a while, see: https://news.ycombinator.com/item?id=22211791

Here's the problem with the business side: If you want to code in extra rules around PINs, requests, whitelisting, you need to route the carrier traffic through a service like Twilio, which is really expensive and cuts down on the margins of the business hard. When you combine that with Apple's margin and taxes, it's a really tight margin I found (even at 6.99$/month). If rerouted traffic could be much, much cheaper there could be a business there -- but there's always a threat Apple will just copy those features. I did get some paying customers though who really liked it.

There's also whitelisting on iOS, might that be enough for your use case? Otherwise there are plenty of blacklist/blocking services.