There is no way it seems to specify the default (nameless) exchange in a publish rule (the routing-key can be restricted of course) as the syntax offers no way to express an empty string as a value.

This means you can't restrict a user to publishing only to a given queue. The rule that does that (e.g. acl allow my-user@QPID publish exchange routingkey=my-queue) will actually allow that user in theory to publish to any exchange as long as the routing-key is my-queue).