Hi Val,
there may be other ways, but this is how I have done it in the past.
Add a data row column to the field to return the DET_ID, can be marked as a technical field. This will be an indicator, whether the row has been saved. I assume you could delete rows, if you didn't save the instance yet.
Got to the permissions tab of a column and use the DET_ID column to decide whether the field is editable or not.
I typically hide the "add" button using css and an html field which will be displayed in the relevant steps.
You could also go to the form definition of a step, define some rules there and break the settings to change the allowed actions. The screenshot shows the configuration of the item list in the form definition of a step.
I for my part, hate to break inheritance. This requires documentation, so that I won't forget it, but I know that I won't read it anyway. :)
Best regards,
Daniel