When the post type is registered, http://codex.wordpress.org/Function_Reference/register_post_type
one can specify custom ‘capabilities’. eg I have an events post type, with event as a base for the capabilities, so automatically, there is a matching set like the page/post capabilties.
Then one can use justin tadlock’s members plugin to assign capabilities to roles. Assign ‘create’ but not ‘publish’ to the ‘review’ post type, but full rights to the other type.
Simple.