If you turn of the contacts for a user in the permissions, they still can see the contacts associated with workflows, they should not be able to.