Settings -> Do Not Disturb -> Allow Calls From {Contacts, Favorites, ...}
Some folks don't like doing this, but I find it a relatively painless way to achieve whitelist functionality. If they're not in my Contacts, they can jolly well leave a message.
No, that won’t do it for me. I run a business where I have different numbers calling me all the time (online sales and service) but I’ve had problems with “No Caller ID” calling repeatedly. So, using a whitelist isn’t going to work for users like me.