After messing around with roles it appears removing privileges from teh "system jobs" on the customization tab fulfills this request. One can still keep the execute workflows to allow workflow to fire. What is odd is there is also a "processes" privilege. in our case most users did not have any privileges for this but did have the system job privilege . So when they clicked on workflows on the left and selected a workflow that had fired they would get an insufficient permsision error.
Unless there is a gotcha I'm not aware of seems like just removing system jobs permsision does the trick.