You can do it with ACL, but there is a steep learning curve if you are not familiar with permission modelling.
"Move" is a permission type that can be applied through ACL rules, which can be limited to a particular object type, state and user/group.
Rules added to the Library default domain will only apply to that library.
If necessary you can create the rules in a sub domain of the library, and have those rules only apply to certain folders which are allocated to that sub domain. Can get tricky as permissions are inherited from parent domains, and are generally additive. I would avoid using deny rules if possible.
You also need read/modify permissions on the cabinet and folder that you want to move into. So you could use this to your advantage, as-in you have permission to move it (in theory) but you don't have permission to put anyway else. This part of the permission model cannot respond to the state of the object being moved however.
