In Odoo 11, only the Manager can unlock an order (same in Sales and Purchase).  So you can lock the order to prevent normal users from making changes, but the manager can unlock the order.

Thanks Mahmou. I understand you.

My issue is - I DO NOT want users to be able to Unlock a PO. In other words, can i take that option from users and where do i do that?

In Odoo Version 10, this feature already exists.

You can see a button called lock after purchase order confirmed.

And after you lock the P.O you can unlock it again.