http://man7.org/linux/man-pages/man7/capabilities.7.html would work for granting limited access to ports, but this doesn’t work nicely as you would have to give it to python.
So I would recommend just putting a proxy in front of Mopidy, for instance nginx. Just make sure to setup proxying of the websocket correctly.