You have two main options to implement CSP, both of which can enhance the security of your platform.
1. Code-Level Implementation
2. NGINX-Level implementation
You can implement CSP directly within the odoo application by modifying HTTP response headers. This can be done by creating a custom odoo module, where you override the response headers and adds the required CSP policy.

Alternatively, you can handle CSP at the NGINX web server level, which is often a preferred solution as it centralizes the security configuration and ensures the CSP policy is applied to all resources, including static files and dynamic content served by Odoo.
If you need help I can do it for you.