M_BEST_EKO is purchase order object whereas PR object name is M_BANF_EKO. Plus you have for service entry sheet. You need to activity 75 and activity 03 for purchase order. It seems you have also given 02 authorization for purchase orders. that is reason they are able to edit PO quantities.
I think you need to spend sometime with you Security consultant to test these scenarios. I will not recommend to for a user exit as it can be well control using authorization objects and roles.