Short answer
HubSpot's KB: in contact-based workflows, use suppression segments, goals or settings to unenroll contacts. Contacts added to a suppression segment are unenrolled and won't enroll while in it. If they're removed from the segment, they don't automatically enroll, even if they meet the triggers. Other workflow types use unenrollment triggers.
1. Triggers
Workflow triggers in my demo portal.

2. Re-enrollment
See why a workflow won't re-enroll.