One way to do this is via the Extra Step feature.

Visit the /shop/cart page on the website and edit the page Style, activating the Extra Step option:

Remove the additional fields on the Extra Step page  - /shop/extra_info - until you have one left, and link it to the Customer Reference field on the Sales Order:

Finally, create an Automation Rule that prevents the update of the Sale Order unless the correct code is entered:

for record in records:
    if record.create_date != record.write_date and record.client_order_ref != 'PRETTY PLEASE':
        raise UserError("Unable to process order")

Your Prospects and Customers will then see this if they don’t enter the correct code: