both variables are needed.
The recordset that is created by the DataAssist wizard should already contain parameter to filter the Order by the OrerID query string.
The section of the documentation you are quoting is titled "Add another Variable (Parameter)"
In addition to the Order ID query string variable, you need to filter on the logged in users ID value.
this is done to prevent users from viewing orders that do not belong to them.