Any organization can classify its information. Mundane corporate security policies have classification levels and different security controls required at each level. The government doesn't need explicit Constitutional justification for that any more than it needs Constitutional justification to buy toner cartridges or allocate vacation days.

Congress gives the federal government's classifications legal teeth with criminal statutes, i.e. https://www.law.cornell.edu/uscode/text/18/798.