There's a really simple blunt way to do this wholesale. Set the "do not edit" property on all the steps in your workflow. That will prevent any edits and hide the button completely, while still letting you do all the workflow actions. It overrides the edit permission in the permission scheme.
You can see an example in the fixed default JIRA workflow - the property is set on the "closed" status. See https://confluence.atlassian.com/adminjiraserver071/workflow-properties-802592825.html for more
You can set it so that some groups can edit as well, but they will get the edit button back if they do that.
From the document Nic pointed, the following syntax will be helpful for your requirement:
some-group-one and some-group-two are the only group members to edit the issue. Add these permissions to all the statuses in your workflow.
I have multiple projects that use variations of the same base workflow. The variations depend on the requirements of the project or issue type. The variations mostly come in the form of new statuses ...
Connect with like-minded Atlassian users at free events near you!Find a group
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no AUG chapters near you at the moment.Start an AUG
You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs