I tried a few permutations and could not get any to work. I suspect it cannot be done because there is no special "clause" that we are using that a lockdown profile could interrogate.
A ddl trigger might suffice ?
SQL> create or replace trigger check_create_user
2 before create on database
3 declare
4 l_ddl long;
5 l_sql_text ora_name_list_t;
6 l_n number;
7 begin
8 l_n := ora_sql_txt(l_sql_text);
9 for i in 1 .. l_n
10 loop
11 l_ddl := l_ddl || l_sql_text(i);
12 end loop;
13
14 l_ddl := ltrim(lower(l_ddl));
15
16 if l_ddl like 'create user%' then
17 if instr(l_ddl,'c##') > 0 then
18 raise_application_error(-20000,'This probably is bad');
19 end if;
20 end if;
21 end;
22 /
Trigger created.
SQL> conn system/oracle@db19
Connected.
SQL> create user c##test identified by test;
create user c##test identified by test
*
ERROR at line 1:
ORA-04088: error during execution of trigger 'SYS.CHECK_CREATE_USER'
ORA-00604: error occurred at recursive SQL level 1
ORA-20000: This probably is bad
ORA-06512: at line 16
and you could add as much (or as little) complexity into the trigger as you want