As an admin I would like a user to only see workflows that were triggered via templates

More info:
A Customer configured a template to trigger a workflow using the orchestrator:workflow:run action.
They need to satisfy the following requirements::

• avoid users to run workflows directly.
• permit the user to see the running workflows.
• permit the user to run template that run a workflow.

At the moment it is not possible to differentiate between runs initiated via a template action and runs initiated directly through the UI. We would like to allow users to see workflows and trigger them only via templates.