Hello,
In transaction OS59 you can create a default change master record profile, in which you can choose the object types which you want to allow to change using the change number. You can make this as a mandatory entry in CC01.
You can set the setting for Overridable as un ticked if you dont want users to override the object type settings.
You can also set this profile as a default value in CC01 and CC02, see this thread which explains how to do that CC01 Default Value Setting
Another option would be to restrict via authorization object C_AENR_BGR. Check with your security consultant for this.
Also for change numbers with release key with global release indicator on, on release the object types are not editable.
Hope this helps.
Best Regards,
Ameya Beri