How can we restrict a user from creating a hold since he can access the universal access of setup?

A user cannot access setup screens.
You do not give access to setup screens to the users.
You control that through Oracle function security.
You assign functions to menus and menus to responsibilities and
finally responsibilities to users.
A function may point to a form or a subfunction (buttons etc).
Read more on Oracle Function security. I have covered few examples
in my videos.
If you do not want a user to modify invoices (like place holds etc) then give inquiry only access on invoices to this user.