Guess I should have tried the BR idea first!

Looks like the parent field not being populated isn't an issue here.   On the route entries table, I made a Before BR that runs on insert.   Added filter conditions where if the parent is not in Draft or Review, run the rule.   In the advanced script I simply plopped in current.setAbortAction(true); with an info message indicating the record wasn't added.

Seems to be working like a champ so far.   Submitters get the normal ACL "security prevents writing" notice and the approvers get the gs.addInfoMessage notice.