There are couple of ways like
1) Write replication event listener
* Do not give the user or a group activate privilege
* This automatically triggers "Request for activation" workflow.
* Modify the workflow and use your decision logic.
It deponds on use case & Most of the cases I have proposed option 2.