How do I whitelist hosts when using 3G?
Little Snitch could help you out here. It's very configurable outbound firewall for Macs. The rule set it supports is comprehensive and you can block based on interface as well as IP ranges. You could set it up with everything blocked, tether, let through just the apps you want, and then enable/disable Little Snitch with this ruleset based on how you're using your Mac at any particular point in time.