The configuration of the global zone is done through the zonecfg command file-mac-profile. The allowed values are described in zonecfg file-mac-profile Property. If the system uses DHCP to set network interfaces, the flexible-configuration must be selected.
The rpool dataset will be restricted but you can add an unrestricted sub-dataset by using add dataset. An immutable global zone can only run zones in unrestricted datasets. All the children of an unrestricted dataset are also unrestricted.
After committing the zone configuration, the zonecfg boot information is written and the boot archive is updated. Reboot the system to boot with an immutable Global Zone.