Webform: recommended permissions handling when using existing contact feature
Not that I'm aware of. Permissions in CiviCRM typically follow the logic "you either have permission to access this contact, or you don't." There isn't really a concept of having permission to access a contact on one form but not in other contexts.

A different approach would be to disable permission checks for the org field on that form, but only allow trusted users to access the form (who are not likely to abuse it by hacking other cids into the url).