Performing a "Approve/Reject" is a change operations, hence it has to be a POST as per OData. Also, doing POST will provide extra security using XSRF Token. So definitely POST is the way to go.
Second use case is a 'READ', with $expand navigating to manager. This navigation property will need to use an association pairing EMPLOYEE with EMPLOYEE. (Self pointing). If employee number is the key and you do not have it, I would suggest a $filter with $expand.