There doesn't seem to be any way to define a policy about which S3 buckets Lambda is allowed to run code from.
With most services in AWS, the usual practice is to define an IAM role that can be assumed by the AWS service so that it can perform work on user-created resources in the account. For instance, Kinesis Firehose isn't allowed to write into one of your S3 buckets until it's explicitly granted permission with an IAM role.
Even with Lambda we have the concept of an execution role, that is the IAM role that can be used by custom code in our Lambda. But that still takes place after the code has been loaded.