It seems there is no way to restrict user from creating favorites or lock them. I checked some standard code and found no single point where permissions are checked during this operation.
You can only completely disable certain type of menu for user, for that one should create entry in table USERS_SSM, the fields are rather self-explanatory:

The favorite items themselves are stored in table SMEN_BUFFC. Theoretically you can lock this table for CRUD and thus prevent users from updating favorites. However, I do not know safe and stable way to do this in SAP, and locking system table can lead to dramatic consequences.