As I can see you are using generic_read_only_user_app module which do it a generic read only for all models. To do it only for one model you will modify the code of check method of ir.model.access which already exists in the generic_read_only_user_app module as below:

class IrModelAccess(models.Model):
    _inherit = 'ir.model.access'
    @api.model
    @tools.ormcache_context('self._uid', 'model', 'mode', 'raise_exception', keys=('lang',))
    def check(self, model, mode='read', raise_exception=True):
        result = super(IrModelAccess, self).check(model, mode, raise_exception=raise_exception)
        if self.env.user.has_group('generic_read_only_user_app.group_read_only_user'):
            if mode != 'read' and model=='purchase.order': 
                return False
        return result