Only Admin allowed to alter order in 'Review' state
The best way to achieve this might be with a custom module. You could use hook_form_alter() to alter the order edit form and add a validation function that checks the order status and the logged in user ID - and throw a form validation error before saving if you want to prevent them.

You might be able to accomplish this point-and-click-style with the Rules Forms module (https://www.drupal.org/project/rules_forms) which adds the ability to trigger Rules events during form validation. I haven't tried that module myself, so I can't say for sure.