Hi,
One role which can only edit the workflow but can not execute it
Yes, remove WORKFLOW right from the user or group(s) the user's in.
the other is can only execute but no right to edit
Yes, set workflow folder to read only for the user or group(s). Users will have to use buttons at the top right of console UI.
Thanks,
-Jon