Create a page layout with the field and use field-level security to hide the field from all other users is how the app builder should meet the requirement of making the comment field on Review private to anyone outside of HR department. Field-level security can control which profiles can view or edit a field on a record. Create an Apex sharing rule, create a sharing rule to share the field with VP of HR with Role and Subordinates, and create a page layout with the field for HR users and another page layout without the field for all other users are not valid or feasible solutions for this requirement.