How to set umask globally?

You can set the umask globally by introducing the statement

 umask 022

(for instance) in either /etc/profile or /etc/bashrc.

Alternatively, since you are on a Debian system, you may use PAM. To enable this, first edit the file /etc/pam.d/common-session and add the line:

 session optional pam_umask.so

then edit the file /etc/login.defs and add (or modify, whatever) the line

 UMASK           002

These settings are enforced after the next reboot, but be careful: both methods lead to a configuration that can always be superseded by users' choice in their own ~/.bashrc, for instance.

If you are really keen on making it impossible to change the umask, you may use the disk configuration in /etc/fstab. As you know, the available options and syntax depend upon the filesystem type.