Phone calls between grocery couriers and their customers

Your company runs a grocery delivery app in 4 cities. Couriers sometimes call a customer to find a door or to swap an item. Today the courier app shows the customer's phone number. Last month 30 customers complained that couriers had texted them after a delivery.

You want calls to go through local phone numbers your company rents instead. When someone calls one of your numbers, your telephone provider sends your server the number they called and the caller's own number. Your server answers with the number to connect them to. The provider shows each side only your number.

You deliver about 12,000 orders a day. At the dinner peak, up to 900 orders are on their way at once, each for about 30 minutes. Customers call couriers too, for example to say the doorbell is broken. Neither side may see the other's real number. Calls between them must stop working 1 hour after the delivery.

Which number does each side dial, and how does your server decide where a call goes?