Read-only/View-only role where there are workflows attached

Summary:

I need to give a read-only/view-only role to some users. They should be able to see the dispatch console and activity details page to read information about the activity, tech notes, closure information etc.

This is easy to configure in the standard pages/forms, however the workflow is attached to the activity directly and not linked to the user. If I made the workflow forms RO for all the values, the read-only user could still (I think) open the workflow step and submit the form just with no data - messing up the workflow sequence.

How can I either hide the workflow from certain usertypes or achieve this in some other way?