The ALLOW_WRITE macro is what you want. You can set that up to only allow job submission from that one specific host.
-Michael Pelletier.