Approval workflow for publishing report in workspace

That's exactly what a workspace is for. Think of the workspace as your ITG environment. Once you are happy with the result you can make the report visible to the respective app audiences and update the app.

NOTE: "A user is trying to publish report" - that user will need to have a Pro license.

If you want to go fancy - consider deployment pipelines (no endorsement!).