Hi Pranesh,
Just to continue with hiding cancel button, one more thought from my side.... a user needs a "Create Requisition" role to create a requisition which is mapped with "CancelPO" and "ChangePO" permissions. What about removing these permissions from "Create Requisition" role with which users won't be able to see cancel/change button on requisitions as well as on orders. This would be very quick without any custom or core code change.
Amit