We tackled this issue by controlling the state of any button that causes a submit behavior with a combination of role and state. So even if the starter saves the form and gets an email with the “resume” link, once they submit the form, it leaves the default stage and moves onto “stage 2”. In Stage 2 we have set all of the buttons that cause a submit behavior to disabled for the starter role. So after the starter submits the form, if they click that resume link, the form is in stage 2 where the submit buttons are disabled for the starter role, and they effectively have a read only version of the form. You will want to control any buttons you have that execute the submit data command.
You will also want to specify a role in the notification so that you can have this level of control. If you don’t specify a role then its going to be much harder to control what those users can do at later stages.
For us we have established a best practice in our processes that we never send a notification with role unspecified. This allows us to always identify a users role when coming in from a link in an email notification.
Hope that helps.