The Sitecore Users who have the “Read” access to any workflow state can see that state in their workbox but only as long as that state includes the workflow commands. For these commands they have the Command Execute Access.
If the admin wants that a particular workflow state should be hidden from a given set of users, you can restrict access to that command or state for those users. This is only done by the Admin user.
For that user has to change permission through Security Editor.
After opening the Security editor add the user you want to give or remove permission using the "Account" option.
Also, check workflow-related options in "Columns". So that you can give or remove workflow access to users.
Now go to your workflow in System> Workflows> Your workflow and allow or denied "Workflow State Delete", "Workflow State Write", and "Workflow Command Execute" to give or remove permission for workflow command and state.
As Shown in the above image I have read, and write permission only for the Draft state to the particular User. So when you check Workbox for that user you only get the Draft state other state is hidden for that user.
If you want that user can see the state but can not do any actions. Then Denied the "Workflow Command Execute" option in that state's command.
This way you can grant permission to users. For example, you have two types of users Editor, Approver. So you can give only Draft state permission to the editor so that editor can create or edit the item and send it to the Approver user who has only Approve state permission. So Approver will approve the content and publish it. In this scenario, Approver can not edit or publish the item until the item is in a Draft state. Same way editor can not edit an item when the item is in an approved state.