I don't think you can do this with a 2013 workflow. But you can easily do it using a 2010 workflow built with SPD 2013. One of the differences between 2010 and 2013 workflows in 2013 is that 2010 has an action for changing permissions but 2013 workflows don't.
Use this REST endpoint to break permissions on the item
/_api/web/lists/getByTitle('YOUR LIST TITLE HERE')/items('YOUR ITEM ID HERE')/breakroleinheritance(copyRoleAssignments=true,clearSubscopes=true)