This is because the HR officer and manager have the access rights to approve. You didn't mention the version here. If it's in Odoo 11, we can select the reporting 1 and 2 in employee form. If you need to restrict the validation by an officer twice, just make a record rule in settings for leave according to the manager and coach in HR Employee form.

For Odoo 10,

1. Add attrs [invisible] attribute for approving button.

2. Add a flag field in the model to check the user is allowed to see approve button.

3. The flag should be a compute button and compare this flag in the filter domain of attrs.

You can check the manager or coach id's user is logged in or not in compute function of the flag.

If you need to achieve this through security rule then you have to add domain in domain filter filed of record rule objects like state in validate and also check the coach or manager is logged in by user.id

example domain :-

For Officers. select Object in record rule for Leaves and fill this domain. change this domain if any additions needed(for your custom work).

[('state', '=', 'confirm'), '|', ('employee_id.parent_id.user_id.id', '=', user.id), ('employee_id.user_id.id', '=', user.id)]