1. Create a new security group to control access to the "Confirm" button.

   2. Assign this security group to the users who should have permission to access the button.

   3. Customize the Quotation/Sales Order form view using inheritance and add the groups attribute to the        "Confirm" button, restricting its access to the newly created security group.

Hi,

Please refer to the code below:

<record id="view_order_form" model="ir.ui.view">

    <field name="name">sale.order.view.form.inherit</field>

    <field name="inherit_id" ref="sale.view_order_form"/>

    <field name="model">sale.order</field>

    <field name="arch" type="xml">

         <xpath expr="//button[@name='action_confirm']" position="attributes">

            <attribute name="groups">custom_module.custom_group</attribute>

        </xpath>

    </field>

</record>

Only members of the group can confirm the sales order.

Hope it helps.