Allow only editing via Action, and then control who can submit an action to only to those who can edit the specific columns. If you create an Action that can only edit column Z, then no-one can edit the other columns.
Just to follow-up, though, there is no explicit control in OMA that would prevent this? You would need to just trust that whoever creates Actions on this Object only edits Z?
Yes, as far as I know, you’re reliant on whoever develops the Action to only make Z editable.
But generally I think only developers, and not users, should have editor rights for an object, and the ability to create Actions. Otherwise you could get lots of other issues if people are incorrectly configuring Actions.