Rather than answer your question directly, what I would encourage you to do is examine the roles within your organization that need *ALLOBJ to perform their job functions and limit the *ALLOBJ assignment to only those roles.
Roles such as the system administrator and security officer regularly run system functions that require *ALLOBJ, so you may want to assign those users (or the group profile representing the security officer role) *ALLOBJ special authority. How many users in each role really depends on how your organization is structured. Do you have a system administrator on site 24x7? If so, you will have more users with *ALLOBJ than an organization that has one or two administrators available during the 1st shift only. Who has *ALLOBJ also depends on how many "hats" one person wears. Sometimes the administrator is also the security officer -- so only one person would have *ALLOBJ. In some shops, these duties are separated.
There may be occasions when a non-administrator needs *ALLOBJ. So what I would do in that case is write a CL program that adopts a powerful (*ALLOBJ) user, performs the task and ends. Again, avoiding giving *ALLOBJ to the user directly.
So while it's not possible to give an exact number, *ALLOBJ needs to be truly limited to those roles that absolutely positively must have *ALLOBJ in their profile or their group's profile and the best way to determine this is to determine the roles on your system and what functions they must perform. (Note that programmers do NOT need *ALLOBJ special authority!)
