Pause all services and functions on my AWS account

When you say objects, I reckon you are talking about S3. You can set the restrictions using SCP.

{
 "Version": "2012-10-17",
 "Statement": [
   {
     "Sid": "DenyAllS3Actions",
     "Effect": "Deny",
     "Action": "s3:*",
     "Resource": "*"
   }
 ]
}

If you want to allow certain IAM roles only, you can try the SCP policy below.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyS3ForSpecificRole",
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "*",
      "Condition": {
        "ArnEquals": {
          "aws:PrincipalARN": "arn:aws:iam::111122223333:role/BlockedS3Role"
        }
      }
    }
  ]
}