I would suggest go for many to many. You'll need another auxiliary entity (data from whose table should not be exposed to the user) such as OrderProductMap.
It will let you maintain orders, and a list of products. In case of one to many from Order to Product, each order will have to create a separate product instance, which is not a natural thing to do. The opposite is not sound either. An order should NOT be limited to a single product.