Active Roles Administrator accounts have special privileges and therefore override any need for approvals defined on workflows. This is true for other tasks as well, not only user creation.
After creating the workflow, test using an account that is not an Active Roles Administrator. For example, test using an account who is a member of the Domain Users group and that has the All Objects - Full Control access template delegated to it, for example.
In Active Roles the Enforce Approval setting will, force the approval on any account that the workflow is applied to.
To enable this option complete the following steps: