Command pattern: best practices

I'm thinking about using the Command Pattern in C++/Qt for implementing undo / redo behaviour in an application. I was thinking about how to practically implement it but all solutions have a drawback. So maybe someone can point me to a best practice.

First I thought that it was best to have a pure virtual base class for every command, every possible command subclasses this base class and implements operation / inverse operation. But the Command subclasses then have no access to the state of the model they are about to modify. I could declare them as friends but I would have to do that for every single possible command as friendship is not inherited. Also I could accept that they have no access to the model and implement a public interface for modyfying it. But then again there would be no guarantee that only instances of the Command class modify the model, so someone could just use the interface methods directly from the UI.

Is one of them a better solution than the others? Or is there another option, like directly enqueuing function pointers to a list to handle inverse operations?