What rules would I need for user ID XYZ123 that allows it to only link to account 123WWW and blocks it or prevents it from linking to any other user ID?

My experience with VM:Secure Rules has been to control access to a user ID that I control, for example "REJECT XYZ123 LINK" would block user ID XYZ123 from linking to my ID. What rules would I need for user ID XYZ123 that allows it to only link to account 123WWW and blocks it or prevents it from linking to any other user ID?

Create a user rule to allow the LINK.

In user 123WWW's user rules you would have:

ACCEPT XYZ123 LINK * * (or whatever link addr and mode you want).

Then, in the SYSTEM DEFAULT (note DEFAULT vs. OVERRIDE system rules) you would have: 

REJECT XYZ123 LINK * * 

You can also issue the VMSECURE QRULES command to verify the rules put in.