RE: Giving access to on demand flows to specific security roles
Hi partner,
Do you mean you want different security roles use different workflows in D365?
If so, there is no OOB way now, but workflow has a selection named "scope", it has four options.

1.User
It is more likely a personal workflow, only the owner of the workflow could trigger it.
2.Business Unit.
All the users in the same business unit as the owner of the workflow could trigger it.
3.Parent : Child business unit.
With this, the workflow will run on the records owned by the users of the same business unit as the workflow user as well as any child business units.
4.Organization.
All users will be able to trigger the workflow in your CRM instance.
So according to the above information, I suggest that you could create business rules to categorize your users and use "Business Unit" or "Parent :Child Business Unit" scope in your workflow.
Regards,
Leo