We recently had a customer who had installed Nintex Workflows 2010 on a shared environment with multiple site collections, each dedicated to different customers.
The issue that he found was that once Nintex was installed, it was apparent to all site collections and each of the site collection administrators was able to activate it as a feature. This caused concern that everyday users could have access to start building Nintex Workflows without governance or training.
The deployment of Nintex Workflows can be targeted to specific Web Applications. However, as mentioned in the article below, it still shows the feature activation option on the web applications that were not targeted in the deployment. To remedy this, the article describes a supported way to hide this feature activation button from all sites. This ensures that Nintex can only be activated through command line activation and not through the UI.
The article was originally written with Nintex Workflows 2007 in mind, but we have recently confirmed with Nintex support that this method applies to Workflow 2010 and is still a supported method.