If you define in a permission scheme that a group has "resolve issues" permission but NOT "close issues" permission, they're still able to close the issue because the "Resolve & Close" button is always visible.

workaround

Add a permission validator in the workflow : check for the user permission : close issue.