You can easily make the comments view only to the role of employee by going into application settings/Roles, select Employee role then over to the last permissions column named Fields, select Custom Access. Find that comments field and make it view only.
On that same permissions page for the Employee role, you should also limit which table record can be viewed and/or modified by that specific employee so everyone with the employee role only sees their review. This should be easy if you have that employee's name on the form which is populated as a user name field. Let's call it Employee Name. Then in both View permissions and Modify permissions' drop down, select Custom Rule. Then just set it to say... when [Employee Name] field = current user.
You can set up a Notification for that table that is triggered when a certain field is completed by the supervisor that will send an email to the Employee in that Employee Name field.
