If you have SharePoint developper resources, you can create an Event Receiver. That ER would be attached to
ItemFileMoving events to cancel them in case specific conditions are met.
Go with an ER and not with a workflow: workflows are not immediate, they have a huge cost, they're visible in the UI, they're terrible to debug, their architecture has changed a lot between 2010 and 2013, etc.
The ER will be implemented as a class in a SharePoint Farm solution project. You can register it either from a feature (with a feature event receiver) or from a configuration page (i.e. a custom application page in _layouts you have to develop too ; this page would allow users to choose the library(ies) to attach the ER on).
My advice would be to not use/trust Visual Studio when you choose an Event Receiver Template to add to the project: that would create an XML registration file, that would attach the ER to all doc libs in the site: I prefer registering the ER "by hand" with custom code: this allows the exact precision I usually need.
You'll find a lot of literature on the Web about this process, e.g. Using Event Receivers in SharePoint Foundation 2010 (targets SP2010, but still relevant for SP2013).