I suppose you want to block access to the "Update Cost" button:

If you enable Developer mode and hover your mouse over the button you can get more information

So we know that this is an "Action" button and the ID is 438.

We need to create an Extension View to limit access.  There's information about creating an Extension View here and this is what it should look like (click on the image to enlarge):

<data>
  <xpath expr="//button[@name='438']" position="attributes">
    <attribute name="groups">sales_team.group_sale_manager</attribute>
  </xpath>
 </data>

Your Button ID/Name may well be different, so simply change 438 accordingly.

This will allow Sales Managers to update cost, but not Sales Users.  You might want to also allow this for Inventory Managers, Accountants, etc.

Note that the same button exists for variants so you'd need another Extension View.