As far as I know, there's no easy way. Qlik Sense security rules are always positive (a user is allowed to do X) - and never negative (A user is NOT allowed to do Y). This means that the way to achieve what you want is to find and allow every single thing you want to be available, *except* interaction with bookmarks.
I would also advise not doing something like this with Root Admin to begin with, so if you do decide to try and approach this, I'd recommend setting it up using a non-default role and keeping the Root Admin one clean. If you use root admin for this, and there are changes to security in future Qlik Sense versions, your root admin might not have access to them if they don't match the existing rules you've created.
