Am I right that by implementation everybody with a client is theoretically able to mine?
Yes, it just won't be very effective without dedicated mining hardware.
Would it be possible (without changing half the code base) to limit the right to mine to some charitable groups and giving the other agents just the permission to do transactions?
Yes, you can do that. You don't have to change very much of Bitcoin to do it, either.
You change Bitcoin so that instead of a block header needing a certain amount of work to be valid, it needs a signature from a certain public key. Then, you distribute the private key to all of the organizations that should be able to mine.
You need to change the code in one other place: the mining logic. Instead of hashing continuously, the nodes that create blocks will do it by waiting a fixed amount of time after the last block, creating a new block, and signing it. (Avoid creating two blocks in two places simultaneously. There are three strategies for avoiding this: wait a random amount of time before creating a block, elect a leader who creates the block, or have a round-robin system.)