Figured this one out. Since I am using the FairScheduler there is an extensibility point there that allows me to achieve my goal by writing a simple class implementing LoadManager interface
According to http://hadoop.apache.org/common/docs/current/fair_scheduler.html, FairScheduler uses instance of a class specified in mapred.fairscheduler.loadmanager config property (CapBasedLoadManager by default). The LoadManager interface provides convinient method
boolean canLaunchTask(TaskTrackerStatus tracker, JobInProgress job, TaskType type)
which allows me to have custom logic to allow or deny particular job to run on a particular task tracker. Problem solved.
Lesson learned: reading source code is useful.