Block drush rsync command when specific alias is set as destination
In the case of rsync, $destination is equal to @staging:%files, which is different than @staging.  drush_sitealias_evaluate_path is not called until after the validate function, and calling it twice would be slow.  You could test to see if $destination is @staging OR if it begins with @staging:.  That should work well enough for your purposes.

If you wanted your policy to depend on values set in your @staging alias, then it would be best to make Drush call drush_sitealias_evaluate_path before the validate function.  That would be a feature request, and should be done by posting an issue (or better yet, a PR) on the Drush project on GitHub.