...does this sound like a right approach?
...once the files are marked private, you can't start any workflow on it.
they can UnMark a private file to make it public...not sure if there is an other way to do this via workflow