You can definitely lock the records if your submit button performs a script. That script can set a lock value in the parent record--the table on which the layout is based--and a lock expression on the portal's table can refer to this related record to determine if a user has access to the records in the portal to edit them. This requires setting up a limited access password for the users for whom you want to lock out of editing the portal records.
See "Editing record access privileges" in FileMaker Help and check out this particular sub section: "Entering a formula for limiting access on a record-by-record basis" for a detailed description of how to set this up.
You can also set a validation rule on fields in the portal table that reject all changes to data if the lock field in the related record is set. This can be one way to keep users from adding new records in the portal--which the lock expression does not prevent. YOu can also prohibit adding new records directly in the portal replacing that capability with a script for adding new portal records and then your script can check the lock field to prohibit creating new records when locked.
This all seems very familiar. Did you post this question before?
There's a whole other side of this issue tied to exactly how/when 'submit' locks the record as this also prevents users from going back and correcting mistakes made during initial data entry.
In the security settings you can set permissions on record by record basis. You could have the submit button also set a field that makes the record have the limited access.