Tukukkk

Our project is to create a blockchain so that a customer can traceback any registered good (such as food or drugs). The idea is to replace money with product IDs. (ERC721 from Ethereum does not do the job because people do not want to own IDs).
Each member of the production chain adds a transaction to indicate to whom the product is given.

The advantages of this system are its immutability and robustness.

We have developed a working blockchain that is very close to Bitcoin but we are wondering how to adapt it.
Indeed, the most important thing is to know what happens to mining. We can't offer IDs when a block is checked, so how do we get people to take care of the chain?
Perhaps we should introduce a digital currency to reward them, but it is not elegant.

To summarise: how to create blocks in a such architecture?

The attacker: a company that wants to hide part of a product's history because a problem with it has been discovered.

The user: a customer who wants to know where his or her purchase is coming from. from.

The Bitcoin blockchain achieves immutability through proof of work mining. It is considered immutable because many economic actors commit their computing power to finding new blocks. If not "enough" people are mining, the blockchain is not immutable. Recently both the Bitcoin Gold and the Ethereum Classic blockchain have been manipulated through a 51 % attack so these weak (i.e. low hash rate) blockchains are not immutable.

If you do not want to worry about having enough miners, you could consider building a token on top of either the Bitcoin blockchain or on top of the Ethereum blockchain (e.g. an ERC20 token). On Bitcoin, the Omni protocol allows for you to build your own token which is transferred on the Bitcoin blockchain. This means that you have to pay transaction fees (to the Bitcoin miners) to transfer the tokens but the benefit is that you will not have to worry about a 51 % attack (other people are trying to prevent that).

If you want non-fungible assets (each with their own ID attached), the Ethereum protocol standard ERC721 is made for this purpose. I am not aware of a similar solution on top of the Bitcoin blockchain.

If you want something else, like a more general, immutable log system in the form of a smart contract, you may have to write your own contract in Solidity (for the Ethereum blockchain) and only allow specific addresses (one for each member of the production chain) to write to this log.

Part of the balance of incentives of Bitcoin that helps prevent attacks is that the miner has skin in the game because the reward is the token itself. Attacking the network (presumably to be able to double spend) is counterproductive since the coin being double-spent would likely decrease in value as users would not want to risk receiving coins that could be reversed).

if a greedy attacker is able to assemble more CPU power than all the
honest nodes, he would have to choose between using it to defraud
people by stealing back his payments, or using it to generate new
coins. He ought to find it more profitable to play by the rules, such
rules that favour him with more new coins than everyone else combined,
than to undermine the system and the validity of his own wealth. - Bitcoin Whitepaper

To achieve a similar balance of incentives you would need to analyze your specific use case. Who would secure the data by mining and what is their incentive? Likewise, who would attack it and what would be their incentive? Storing data in a blockchain data structure doesn't make it immutable. It is a combination of the network consensus rules and the balance of incentives that make the data (relatively) immutable.