Explanation:

Step 1: Enable field security in the Approval field.
* Enable field security on one or more fields for a given entity.
* Associate one more existing security profiles, or create one or more new security profiles to grant the appropriate access to specific users or teams (step 2 and step 3 below).
Step 2: Create a new field security profile.
Create a new field security profile for the sales manager.
Step 3: Set the field permissions...security profile
Step 2 and step 3, example:
Configure the security profiles.
* Create the field security profile for sales managers.
* Go to Settings > Security.
* Click Field Security Profiles.
* Click New, enter a name, such as Sales Manager access contact mobile phone, and click Save.
* Click Users, click Add, select the users that you want to grant read access to the mobile phone number on the contact form, and then click Add.
* Click Field Permissions, click mobilephone, click Edit, select Yes next to Allow Read, and then click OK.
Reference:
https://docs.microsoft.com/en-us/dynamics365/customerengagement/on-premises/admin/field-level-security