Just declare that everything outside of the CRB (or whatever preferred sources) is rare. You still retain the option of including something as a treasure or a reward, but character building doesn’t get out of control.
You absolutely can.
It's more controversial to do so than in 5E, however. The culture of Pathfinder 1, for instance, was outright player entitled as far as I can understand, hostile to the idea a GM should be given the right to deny a player some splat book feature.
Even now Paizo is wavering and much less clear than WotC on this issue. Let me take a stab at explaining this to the best of my ability:
1. First off, every rule is freely available at online SRD databases; you get a culture much more open to the idea of using "everything".
2. Classes are much more defined as collections of feats than a nice simple writeup where most of what you need to know to form an opinion "what is this class about" is right there, in the beginning of the book. Unless you read the physical CRB, you must go out of your way to restrict online filtering to "CRB only".
3. I know Paizo created rarity to combat this problem, but by labeling things Common in splatbooks, they have inadvertently(
†) created something of a stamp of approval. It's hard to say no to your players when they argue "but it's common, Paizo clearly wants us to use this stuff".
†) I mean, common can be read as "the stuff that
isn't uncommon or rare". But it can also be read as "common is the things we believe is safe to use in any campaign - if it could be used to surprise the GM or shortcircuit a campaign in some way, we would have made it uncommon or rare".
In our current campaign, I have gotten my players aboard the idea "no uncommon or rare content except what's specific to the campaign, since it is our first PF2 AP". Note how this means every common feat from books like the Lost Omens Character Guide and the Advanced Player's Guide becomes available to our characters just as soon as the books are out (or rather, as soon as the Pathbuilder app gets updated). Saying no to that felt overly punitive. Contrast this to 5th Edition where WotC makes it
much easier to say "
PHB+1 and that's it".
4) Paizo is actively undermining their own stance on restricted content, since "uncommon" is used for multiple purposes.
4a) Yes, it is used for spells and rituals like Speak with Dead and Raise Dead (since the former spell can wreck a low-powered mystery if the players can just ask the murder victim who killed her, and since the latter spell allows characters to simply undo the murder so no adventure is needed)
4b) But "uncommon" is also used for its more literal interpretation - this weapon is uncommon around these parts, so you can't expect to easily find it in the shops. That is, a rules element can be uncommon simply because it's assumed to be exotic. Only characters from far-away lands know how to use it, and so on.
4c) "Uncommon" is also used for campaign-specific items. Each AP contains a multitude of new rules elements (items, feats, archetypes...) and some of it is labeled uncommon. To the best of my knowledge, this usage does mirror the "PHB+1" idea in that a campaign should not be drowned by including everything from previous campaign. If you run Extinction Curse, players may select circus weapons. If you then run Agents of Edgewood, including those would be inappropriate. This also helps making each campaign feel special.
4d) There are even feats that let you access uncommon rules elements - and these feats are themselves not uncommon! Go figure...
(Far from every uncommon rules element can be accessed this way. These feats are always(?) specific. But still)
The end result is that the message sent is incredibly unclear. I believe it is very unfortunate how this allows player entitlement to seep over from PF1.
I realize I am not fully cognizant of Paizo's intentions and goals here, and I am absolutely open to your views on the issue.
