You should use 400 for business rules. Don’t return 2xx if the order was not accepted. HTTP is an application protocol, never forget that. If you return 2xx the client can assume the order was accepted, regardless of any information you send in the body.
From RESTful Web Services Cookbook:
One common mistake that some web services make is to return a status
code that reflects success (status codes from 200 to 206 and from 300
to 307) but include a message body that describes an error condition.
Doing this prevents HTTP-aware software from detecting errors. For
example, a cache will store it as successful response and serve it to
subsequent clients even when clients may be able to make a successful
request.
I’ll leave it to you to decide between 4xx and 5xx, but you should use an error status code.