Access restriction of direct Purchase Order Creation

Summary

Requirement is to restrict the access of direct PO creation but user should be able to Process PR to PO

Content

Requirement is to restrict the access of direct PO creation but user should be able to create Purchase order by any of below steps

1. Process an approved PR to PO

2. Process and Approved PR to an RFQ and RFQ shuld be converted to a Purchase Order.

In order to achieve the above, we have created custom roles separately and assigned both of them to same user. Since "Create Purchase Order" privilege is required to create purchasing document from RFQ, we have assigned it to the custom role. But the issue is, by assigning the same privilege user is also getting the access of Direct PO creation also.