I've RTFM again and it seems it makes sense to create a child association and disable permission inheritance. It doesn't seem possible to have different permissions for aspect properties and type properties.
You are right that you can't tie the type directly to permissions. However each node can have its own ACL so you could implement this via a policy for the type or aspect.