Allow only editing via Action, and then control who can submit an action to only to those who can edit the specific columns. If you create an Action that can only edit column Z, then no-one can edit the other columns.
Just to follow-up, though, there is no explicit control in OMA that would prevent this? You would need to just trust that whoever creates Actions on this Object only edits Z?