Use Case: Specifying additional constraints / preferences when selecting target resources (Nodes) (e.g. prefer a specific Firewall)

How does a service template designer provide additional "constraints" to the provider deploying the template in order to convey preference of certain node types (or resources) over another.

Example:
A service template declares its need for a Firewall node, but prefers type AAA over type XXX due to reliability.

Notes:
Aaron: High Level Suggestion: Extend TOSCA NodeTemplate/NodeType to support specifying additional conditions for target VM resources.
Options:
a) Let the deployer specify/recommends the firewall(s) he trusts
b) Let the deployer specify the firewall(s) he doesn't trust.
Matt: Perhaps an alternative use case using an artifact type to allow desire for matching to a specific Java runtime (provider, version) over another. Could these be constraints expressed as Reg. Exp. against node or artifact properties?

Reference:
https://www.oasis-open.org/apps/org/workgroup/tosca-interop/download.php/48504/New%20Scenarios%20for%20TOSCA%20from%20Huawei.pptx