My brain was working when I wasn't paying attention, and I thought of a decent workaround to disabling the vendor Finder key. First disable the Edit Columns option for a user. Then, for that user, remove all fields from the vendor Finder (and SmartFinder) grid except for the vendor code.
So the user will be able to pop the vendor list, but they won't be able to see the vendor name or address!
I guess a user could still break security by creating a new requisition and selecting vendors one by one to see each vendor's name, but someone would have to be very curious to go to that trouble.
Thanks Douglas for seconding my suggestion about having separate auto numbering options for requisitions and POs.
Steve