Time Card Questions - Managers vs HRs

Content

We have a requirement that we don't want Managers to edit the card time once it's approved, however, we want HRs to be able to make changes for approved timecards and as well as do retro changes. I believe, there is only one role "Time and Labor Manager" which has access to review the edit the time card. So if we create two roles, one for Managers and the other one for HRs, but if we remove the access to edit the Time Entry Profile for approved time cards it may not work. Is there a solution to this requirement?