Is there any way to control who has permissions to set stack tags? I wasn't able to find anything to this effect in the docs.

no, but pls open a service request if this would be useful to you! https://github.com/pulumi/service-requests