I am trying to create a Sitecore 9 user role that allows users to create content but not have the ability to publish it. How can this be done without programming?
I create a new role, limited the content areas that the users of that role would have access to. Even without assigning Sitecore Client Publishing role, the user can still publish. I was expecting the option would not be available. Could I update the Workflow settings?
This is controlled by workflows in Sitecore. A Sitecore solution should be designed in such way that any user can trigger a publish of anything at any time. Publish restrictions should be used to prevent content from being published. It's sometimes also good to remove the publishing access rights from users when there are othre requirements/limitations such as having a scheduled publish running on a fixed period etc.
To control publish restrictions through workflows, you create a workflow with at least two steps, like "Draft" and "Ready for Publish", where the last one is publishable. Then you add a transition action, such as "Approve for publish" on the "Draft" state. Then assign Workflow State access rights to the states and Workflow Command Execute rights to the workflow actions. Thereby you can have a group "Authors" that can edit the items in Draft state and a group "Approvers" that can transition the item to the next state. Then assign the workflow to you items, typically by assigning the Default Workflow on Standard values. Look at the "Sample Workflow" that comes with a default Sitecore setup for more details. Having three workflow states typically makes it easier to know what's been done editing and is just awaiting approval.
Keep in mind that workflows will just prevent the assigned version from being published, so modifications to shared/unversioned fields may still be published without going through the workflow process.