Do I need to install certificate on each workgroup machine?
If your site only accepts HTTPS, then yes.
Do I also need to install root certificate on each workgroup machine?
Trusting a certificate means that the CAs within the issuing chain of the PKI that issued the in-use certs are added to the appropriate certificate stores, yes. This includes the root CA, any intermediate CAs, and the issuing CA. This is core PKI operations and unrelated to ConfigMgr.