Hi,
Our friends have given you good options to map this issue. The way I see your issue is "No project/WBS should be created if it is not assigned with IM program type/position" .Correct me if my understanding of your issue is wrong.
If correct, then the easiest way I can think of is the removal of create/change roles from authorization object C_PROJ_VNR. As with IM-PS integration IM will fund WBS (generally level 1) and project definition be created automatically along with the funded wbs element. (Not sure this authorization object will work or not)
Second option, try auth. object C_PROJ_TCD and remove roles/activities related to project definition master data creation (like activity 0102) . In this way also users shall not be allowed to create project definition directly.
Third option,Why to give full fledged CJ20N authorization to users, Even if you want to give then control it using authorization object as I mentioned above.Else better way around is give them enjoy transactions specific to WBS creation ( don't provide them CJ20N with project manager roles for project creation,or transactions like CJ01,CJ27,CJ2B should be removed from their roles.)
Let us know if you have any issue in all the options mentioned in this thread.
Regards
Saurabh