Since you only want them to be able to edit the status field and nothing else I would not give them access to the node edit page. The editablefields module allows you to allow the user to change a field on the nodes page using AJAX. You may still need another module to get the permissions all worked out.
Or you could create a custom module/block which lets the user change the status and make the block only show up on node pages of that content type.