Restrict creation of content type by user reference
I would create a custom module that uses Entity Field Queries to do the following: 


First, use EFQ to select nodes of type "location" where "user" matches the "user" specified in the selected "event" AND also the "location" value matches the "location" specified in your event. This has essentially the same effect as the Views solution you've worked out, I believe.
The advantage over Views here is that now you can node_load() the nodes you find or you can execute more complex logic if there are no matches (i.e. if the user should not have permissions).
Use hook_node_grans() or hook_permission as needed.