In order to allow for delegation of these Azman objects without also allowing the creation of these unwanted object types, the solution is to edit the Active Directory Schema to modify the default security permissions for the objects in question.
Generic instructions and cautions for editing default schema permissions are referenced here:
265399 HOW TO: Change Default Permissions for Objects That Are Created in the Active Directory
http://support.microsoft.com/kb/265399/EN-USUsing instructions from KB265399, The solution is the modify the following objects:
msDS-AzAdminManager, msDS-AzApplication and msDS-AzScope
as follows:
Using ADSIEdit.msc:
The default security descriptor attribute contains several all of the ACL entries for the object.
For example:
D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;CO)(A;;LCRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA)
Modify the entry for Creator/Owner:
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;CO)
For each object type, modify Creator/Owner portion (CO) of the default security description to look as follows:
(A;;LCSWRPWPSDRC;;;CO)
Ensure to only modify the Creator/Owner portion of the default security descriptor attribute leaving the other sections of the default security descriptor unchanged.
The resulting security descriptor attribute would then appear as follows:
D:(A;;LCSWRPWPSDRC;;;CO)(A;;LCRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;DA)
Using Active Directory Schema MMC snap-in:
Alternatively, the default security descriptor for each object type may be modified using the Active Directory Schema MMC snap-in.
For each object type, locate the object name under Active Directory Schema Classes folder in the Active Directory Schema MMC snap-in.
Right-click on the object class name and select Properties.
Select the "Default Security" tab on the object properties.
Select the "CREATOR OWNER" entry under the Group or user names list box.
With "CREATOR OWNER" highlighted, click the Advanced button.
With "CREATOR OWNER" highlighted, click the Edit button.
In the Permissions listing, by default all permissions options will be checked under the Allow column.
De-select the check box for Allow for the following items:
Full Control, Modify Permissions, Modify Owner.
Click OK.
Click Apply and Click OK in order to save these changes.