A company is setting up a multi-account AWS environment using AWS Organizations. They need to ensure that no account can deploy resources in the ap-northeast-1 region, except for a specific 'Global-Security' account. What is the MOST operationally efficient way to achieve this?

Create an IAM policy denying access to ap-northeast-1 and attach it to all IAM users and roles in every account.

Apply a Service Control Policy (SCP) at the root level denying access to ap-northeast-1 with a condition excluding the Global-Security account ID.

Use AWS Config rules to detect and automatically terminate any resources launched in ap-northeast-1.

Remove the ap-northeast-1 region from the AWS console for all accounts using AWS SSO.