How to restrict users not to make changes to a sales order that has been approved, but the system should only allow them to close the sales order if no longer valid

This is the BPM I have created. It checks

  1. If the sales order is already approved.
  2. If the change time has changed to another.
  3. If the user does not belong to the group for sales order approver security group.

I also added another condition as it was affecting the shipped

  1. If the sales order is already approved.
  2. If the change time has changed to another.
  3. If the user does not belong to the group for shipper security group.

It then throws an error if above is not met. So currently the one who created the Sales order cannot close because the closure action changes time for any to another and the person does not belong to the two security groups.
Remember the goal is to ensure the person who creates the sales order can only close but cannot make any change on the sales order so long as it is approve.