How to restrict Jenkins node by label for a group of users

Question

The situation

Say I have a Jenkins installations with multi-branch pipelines which executes on nodes which are implemented as ECS Tasks in AWS. The nodes have speci