Restricting account access to specific objects

There are multiple type of users, maybe one of the predefined has what you are looking for. I don't think you can select individual object types (as you said, excluding partitions), must be something related with the modules (like LTM).

This is the documentation about user accounts in v12:

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-12-0-0.html

This is the section that has the user roles available in v12:

https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-user-account-administration-12-0-0/4.htmlreferenceid