You can restrict the priviledges for users but a script can be run with full access priviledges
At the bottom of the script edit window is a check box to "run script with full access" or something to that effect. This gets around such things.
You might consider locking browse access to the PO field rather than the layout. Then scripts can modify the field but users cannot directly edit it. (If this field is the primary key you use to link a PO to other records such as a line items table, it should be an auto-entered serial number and you can select the prohibit modification field option to keep it from being changeable by anyone or any script after the record is created and it receives it's original, unique serial number.)
You can do what PhilModJunk did. That sounds like a good idea.
If you need to change a number, you can temporarily change the settings, but...
I have an idea which uses a script trigger. Though, I have some concern about it.
Have a script trigger on the field that checks if the variable(the copy; PO) is empty. If it isn't empty then it is being used and kicks it out of the field using Go to Next Field step. If the variable is empty allow it. When a user is done entering the data, they can click the button and the variable is empty once again.
Since the variable is a copy you can specify it to lock for only that record instead of that field for all records.
Hopefully this makes sense. If not let me know.