I believe this has to happen in 2 steps.

step1: Currently admin can't restrict workflow creation in databricks  currently any user with workspace access can create workflows. Admins should be able to restrict workflow creation. Databricks doesn't have this feature/functionality, this something simple to implement. not sure why they didn't.

Step2: First step eliminates all unwanted users. coming back to be able to review notebooks to be attached to clusters from workflow tasks. you can make use of git PR's and use databricks assets bundle to deploy code, workflows.

i think step 1 is must, unless admin able to restrict unwanted users from creating workflows any user can create workflow and the challenging part is user can create workflow in any workspace (prd,qas,dev,etc). Our workspaces are already messy with lot of workflows.  I hope databricks implements this feature soon.