"The same employee cannot write multiple reviews" - they can create new accounts.

But even if you want one account to not write multiple reviews, you can flag that an account wrote a review for a company without tying it to -what- review.

You can even disassociate that; hash usernames with the company and store that to track who has written a review. Then, you can only confirm that a given user account has written a review for a company, but not which review is theirs, and given a company you can't determine what users wrote those reviews without attempting to hash every username against it.

And that's if you -absolutely- have to try and prevent an account writing more than one review (again, noting that you can just create another account).