Orders can have one the following Sharing models
- Controlled By Parent
- Public Read Only
- Public Read/Write
If you use Controlled By Parent, and the profile grants access, all orders will get the access.
* When the Order Sharing mode is private, each order queue must have at least one member. If you are using order queues, please confirm in Orders setup that each queue has members
Remember that salesforce (for now and unless you are in the pilot of restrictive permissions) always works by opening permissions.
This means that you start by restricting as much as possible, and then opening it to the people / profiles / roles you want. (not having it opened and do something to close it / restrict it).
So I guess you could start by putting it in Private and start granting access from there.
Also keep in mind that Order Product's sharing setting can't be customised**, so without a custom solution you won't be able to control to which items they have access to.
If they have access to the Order, and access to the Order Products object (eg. read access), they'll have access to all order product records associated to the order
**(that I know of, but maybe by opening a ticket it is... I still remember the days when you had to open a ticket to get PriceBooks as No Access )