Is there a way to restrict new database creation to a particular zone? We have a sharded mongo cluster with a database per client model. Given many roughly same size clients - the default db creation has proven to work well at evenly distributing the load, while avoiding multi-shard queries.

Up till now, all shards were homogeneous SSD based deployments, however now, we are trying to add heterogeneous larger but slower HDD based shards - so each clients can have few large bulk collections located there (while their primary shard stays on SSD). This is easliy accomplished with the zoning method (2 zones, hdd and ssd) - and would work very well if for one issue:

TL;DR: Are there any ways to restrict new database creation to only happen on SSD shards?

Only way I know of is to let DB creation happen, then check where it got created and use movePrimary if it is in wrong zone. Issue with this is that process is manual and involves hunting down and restarting every mongos router - as movePrimary was not quite designed to be production ready....
Answer is yes and no. Clustered system marks DB's primary location to shard what have less DB's. Trying to distribute evently. So, automatically you cannot define that location.

IF you log into specific replica set directly and create DB there, then that's it DB's primary location then.

However, you can use that movePrimary command (without mongos reboot) if you move sharded collection. You can shard collection what don't exists, you move that non-existing collection to wanted location and then "drop" that collection. DB have new primary location and all mongos knows now that new location. ;-)