Permissions in CiviCRM
There is a rather hidden feature for Drupal and WordPress (last time I checked this was not working in Joomla) that you can enable at Administer &gt; CiviContribute &gt; CiviContribute Component Settings and Enable Access Control by Financial Type.  See the help icon next to the setting for details (pasted below).

When you have done that, you should see new CMS permissions for Add, Delete, Edit, View for each financial type, so if you can arrange for your online donations to use a different financial type than other contributions then you can set permissions accordingly.


  Enabling Access Control by Financial Types is only required if you need users in one role to access some financial transactions but not ones with certain financial types.
  
  For example, Planned Giving bequests may be highly confidential and not appropriate for staff organizing events to see, even though they need to be able to administer the payments for ticket purchases.
  
  After enabling, you will be able to set create, view, edit, and delete permissions separately for each financial type by navigating to Administer > Users and Permissions > Permissions (Access Control), and clicking on the Access Control link for your CMS.