About user type

is it possible to add another type of user—guest. Guest can browse but cant play all kinds of media in the lib, and they cannot actively change the password and avatar.

I don’t believe there is that kind of granularity in user permissions in the current core. If you want to restrict what can by played you can limit a user to only specific libraries

how about restrict certain user to access profile page?

No this isn’t currently possible either