You may be able to do this via User Roles and User permissions. But Custom Objects are a systemwide thing, so why exactly do you want to restrict it?
It's also read only. I find most users don't poke around parts they don't understand anyway....good documentation can help.
What exactly are you trying to accomplish? Custom objects can really only be interacted with through leads via smart lists and email scripting, both of which are partition-aware and gate access to leads on that basis, so I'm not really clear on where your concerns are coming from.
We are using workspaces to differentiate multiple industry data in our sandbox environment.
Idea is to clone the whole workspace/partition from sandbox to actual production environment after the testing has completed. (Basically we are limited on number of Marketo instances allowed for testing and want to maximize the usage of this Sandbox instance)
Perhaps there are other ways to achieve the same? Any clues would be helpful as we are still new to Marketo.