If you go into the Workflow Administration Console you can set permissions in the Security section under Permissions and Rights.

General permissions dictate what each user can do, so you want to make sure the users in question are not admins.

Workflow Rights can be used to set a user's permissions for each individual workflow published on the server.