So I "Asset-Enabled" my custom entities and started using the build in workflow.
However, there are these questions:
1. How to prevent that the elastic search returns entities which are not approved?
2. How to prevent that Asset Publisher finds entities which are not approved?
3. I never enabled Workflow for my entity in the portal configuration. But it's working anyway. So what is the setting good for? Or how to check if workflow is enabled? If I could check the setting than I would be able to start or not start my Workflow instances with respect to it...

The last time I actively asset-enabled an entity is a while ago, this is not an authoritative answer:
1+2: I'd expect both to be related. It's important that no unapproved content is shown, no matter what. As Elasticsearch might return more and there'll be permission checks anyway, I don't know on which side I'd expect the unapproved assets not to show up.
3: What do you mean by "it's working"? You can set the global default, but change your mind site by site. So even if you haven't enabled workflow in portal configuration, you can still do so on site level

Hm... I think I've found some hints here...
Yes, you are right. 1+2 are related. Looks like there's one index and either the entity is indexed or it's not.
So the reals question is how to remove or add the entity to or from the index.
There's this class "[MyEntity]ModelIndexerWriterContributor" and the method:

public IndexerWriterMode getIndexerWriterMode(Entitiy entitiy) {

        if (entitiy.isApproved()) return IndexerWriterMode.UPDATE
        return IndexerWriterMode.DELETE;
}

This method is called upon reindexing. And as every update of an entity should trigger the start of a workflow instance AND a re-index, the entity gets removed from the index as expected with this code above. Nice!
BUT:
If the reviewer approves the entity apparently there's no re-index triggered and therefor the entity is not found when searched.
Is there a scheduled re-indexing running? Or, if not, how to re-index the entity again?
With 3. I mean that the settings seems to make no difference. If I have code like:

AssetEntry assetEntry = assetEntryLocalService.updateEntry(...) and 
WorkflowHandlerRegistryUtil.startWorkflowInstance(...)

the workflow starts and the reviewer is informed with a notification! No matter if I enable the workflow for the entity or not.

Update:
I forgot to add the REINDEX Annotation on my updateStatus implementation!
With this code:

    @Indexable(type = IndexableType.REINDEX)
    public Entity updateStatus(long userId, long entityId, int status, ServiceContext serviceContext){...

it's works like expected :-)
So questions 1+2 are resolved ... Anybody on my question 3.?

OK! There's the global setting and the site setting. Like Olaf said. I simply missed one of them.
Once implemented workflow can be enabled and disabled. Problems solved (for now...)

Another question:
In earlier versions of Liferay the comments users made when completing workflow tasks went to the activity section of the workflow.
In Liferay 7.3 this seems to have changed. Looks like only the user who triggers the action with the comment can see the comment in his activity list. The user who's assigned the task (for example after a rejection) gets a notification but the comment of the reviewer is NOT listed under his activities.
This may be by design, a bug or an error in my implementation...
Looking to the source code of Liferay I can't find code that transfers the comment to the next assignee.
However, if I look at the "Single Approver" Workflow definition XML I can see that by default an e-mail will be sent and there's also a freemarker template for the notification.
Do I have to script the workflow definition to transfer the comments?
Can someone please shed a light on this.

In the meantime I'm sure this is a bug:

https://issues.liferay.com/browse/LPS-122224