Hello.

Any user can be denied access to a given document and prevented from checking out the document.

The workflow process automatically notifies the members of the authorized roles that there's a document waiting for their approval. It also sends a notification to the document author (the user who last edited the document in the Edit step and sent it to the next workflow step) when the document status changes. Lastly, a notification is also sent to all users who have the Manage workflow permission for all content.

For questions 1 & 2, this process would happen automatically if the users have the Manage workflow permission for all content
devnet.kentico.com/docs/devguide/index.html

3.) You cannot allow a user to check-in/check-out, and/or approve and reject a document in the workflow without allowing the user to edit the document. The workflow events are consired editing a document, so you cannot deny the user edit permissions, and allow them to access the workflow. You cannot have a role tht can only approve and reject, without the edit rights.

Best Regards,
Radek Macalik