hmm, if you mean changing the RootAdmin security rule, then I recommend against it. It is better that you create a new role from the security rules and give it the permissions you want.
In security rules there is an option to make the rule QMC only, hub only, or both. You can select hub only. Additionally, you can only select read permissions so users cannot edit. To exclude the other users bookmarks, add a condition that user name = app object owner name.
Maybe someone with better expertise on security rules can give a better answer.
Also this community discussion https://community.qlik.com/t5/New-to-Qlik-Sense/All-app-object-access-except-sheets/td-p/1204075 might give you some additional information.
