Only Admin allowed to alter order in 'Review' state How can I make an Order with status of Review read-only to the creator user? And once the Admin updates to state to 'Payment', the creator user can continue as normal?
The best way to achieve this might be with a custom module. You could use hook_form_alter() to alter the order edit form and add a validation function that checks the order status and the logged in user ID - and throw a form validation error before saving if you want to prevent them.

You might be able to accomplish this point-and-click-style with the Rules Forms module (https://www.drupal.org/project/rules_forms) which adds the ability to trigger Rules events during form validation. I haven't tried that module myself, so I can't say for sure.