thanks, the scenario is:
sale.order has two groups: admin and regular user.
At first both users should be able to CRUD the sale.order. Afterwards only admins can mark the sale.order as "done", once it reaches this state, then regular users should not have write permissions on sale.order anymore. 

I have done this with Record Rules, on regular user's group:

Rule 1, sale.order, read, create and delete

Rule 2, sale.order, write if sale.order.state != "done"

But as I said before, once sale.order.state == "done", the regular user cannot open (read) the sale.order form cause it shows a Denied write error....

Hi,

1. Go to settings->user & companies -> Group-> create

2. Select the application as sale 

3. select the users

4. set the access right -> model (sale)-> Tick the read access only

You can refer to the YouTube video on Security in Odoo 16: Groups and Access Rights in Odoo | Odoo 16 Development Tutorials

https://www.youtube.com/watch?v=PmSepSujsBk

Hope it helps

Not sure whether this is practical for you, but you could copy the Form View and amend the XML to make the Form Read-only.  Authorize some users to only the new menu option running the updated form view.