It's not possible right now to restrict send permissions for assets, though it's something we have considered and the APIs and internal database structure is already ready for.
In the mean time, perhaps you can use the chain's burnaddress (from getinfo) as an alternative strategy? This is an address to which assets can be sent and never recovered, which all nodes can see. You could construct a single transaction that burns some of one asset, and moves some of another, using createrawtransaction, then it could be signed by all involved parties before transmitted and confirming.