RE: Limiting access to substatus values
Yes, it takes a bit of an understanding of security but, by using business units and BU level read, append, and append to permissions, you can achieve your goal.
Role A is in BU A, Role B is in BU B. Then make Awaiting Payment owned by someone in the BU A Business Unit and BU B owns the Paid substatus. In this way, they will not see the records not in their BU.
If there are some substatuses that are shared, use teams to add the users both to more than one BU.
If they share most records and only don’t share a few, I’d add them both to teams that belong to the respective BUs that you will use to give them access to the smaller set of specially privileged records.
If this was hard to follow, read more about security, business units, and teams.