You will need to write a method code for this scenario.
To "block" the Add action you can try to add Server Method onBeforeAdd of the your relationship and check current activity of the WF of "source" item - if on this activity user not allowed to add - you can throw an error
For other actions (update\delete):
you can add method to specific activity. When WF hitting this activity, you can assign specific permission to all existing relationships, on managed Item, with Permission ID that will be empty of any identities or only those that allowed to change existing relationships.
if you are hitting activity that is "open" for update you need to set permission ID to one that allow all relevant user to update the relationship data
I assume that you have only one active activity, if this is not a case, my proposal (second bullet) will not work as expected. So you will need to think about another events to put your methods on.
You will need to write a method code for this scenario.
To "block" the Add action you can try to add Server Method onBeforeAdd of the your relationship and check current activity of the WF of "source" item - if on this activity user not allowed to add - you can throw an error
For other actions (update\delete):
you can add method to specific activity. When WF hitting this activity, you can assign specific permission to all existing relationships, on managed Item, with Permission ID that will be empty of any identities or only those that allowed to change existing relationships.
if you are hitting activity that is "open" for update you need to set permission ID to one that allow all relevant user to update the relationship data
I assume that you have only one active activity, if this is not a case, my proposal (second bullet) will not work as expected. So you will need to think about another events to put your methods on.