only permission I can think of is permission for Sales Order --> which controls access to SO transaction. You may be able to use a user event or client script to disable the lines for specific roles