file.js

function addH1() {
    document.body.innerHTML += '<h1>okay!</h1>';
}

// this lets callers from `file.js` through to the original version of
// innerHTML but not other callers
(function(){
    const innerHTMLDesc = Object.getOwnPropertyDescriptor(Element.prototype, 'innerHTML');
    Object.defineProperty(Element.prototype, 'innerHTML', {
        get() {
            let stack;
            try { throw new Error(); }
            catch(e) { stack = e.stack;}
            if (/file.js/.test(stack)) {
                return innerHTMLDesc.get.call(this);
            }
            return "nah";
        },
        set(value) {
            let stack;
            try { throw new Error(); }
            catch(e) { stack = e.stack; }
            if (/file.js/.test(stack)) {
                return innerHTMLDesc.set.call(this, value);
            }
            return "nah";
        }
    });
})();

index.html

<h1>no user innerHTML</h1>
<script src='file.js'></script>