As long as you make sure
all GPIO's are in their correct state at boot, you can use them all in your application.
This means that GPIO0, (GPIO1) and GPIO2 must be pulled HIGH (via a resistor) and GPIO15 (via a resistor) is pulled LOW at boot.
In one of my projects I used this as a feature: GPIO0 is connected to a "Function"-button: when it is it pressed at boot, I can upload firmware, at run-time it's just the "Function"-button.
If you don't want end-users to (easily) be able to enter flash-mode, you'll have to carefully think about what GPIO's you want to use and/or in what mode (INPUT or OUTPUT).
The only GPIO's you "Can't" use are GPIO6 ~ GPIO11 since these are connected to the on board FLASH memory.