Creating an account for Staff that only allows access to Orders:
1. Create the account as a normal VM front-end user (registered)
2. Go to Admin->Users and select the new user
3. Click on the "Shopper Information" tab
4. Set the Permissions dropdown to "storeadmin"
5. Save
6. In the left menu, go to Admin->List Modules
7. As Kelvyn says above, copy your existing permissions.
8. In the column labeled "storeadmin", only check "store", "order" and "account" (all others should be unchecked).
9. Click the "Save Permissions" link.
10. In the row labeled "Store", click the "Function List" link.
11. As Kelvyn says above, copy your existing permissions.
12. In the "storeadmin" column, uncheck all functions.
13. Click the "Save Permissions" link.
14. Go to Extensions->Module Manager
15. Select the login module you're using (usually either mod_virtuemart or mod_virtuemart_login)
16. Enable "Show Account Maintenance Link" or "Show Administration Link" (the wording is different in the 2 modules)
17. Save
Now, when a staff person logs in to the front-end with this new ID, they will be shown an extra menu item labeled Admin. When they click it, they are taken to the VM Admin area, but with a limited menu. They don't even see any of the Joomla admin functions. They will see some functions that you may not want them to see, but if they click them, they will not have permission to make changes. They will, however, be able to view and update all Orders.