A business must restrict resource creation to approved Regions but still support required global services. What is the best implementation approach?

1. Deny every action outside one Region with no analysis of global service endpoints.
2. Set the default Region on developer laptops as the only enforcement.
3. Use a carefully scoped Region-deny SCP with tested exceptions for required global service actions.
4. Use only a billing alert for resources created elsewhere.