Workgroup membership is controlled in Interaction Administrator > People > Workgroups (or on the Workgroups tab for a specific user).
Workgroup queue activation (for ACD queues) can be controlled in IC Business Manager and requires the Activate Others Advanced Access Details permission (Interaction Administrator > Roles > role_name Security tab > Access Control > Workgroup Queues, Advanced Access Details button, Activate Others).