1. Those checks aren't informed on engine level. Currently, a user only sees tasks (in explorer) that are either directly assigned to him/her or is member of candidate-group. If you want additional checks or mechanisms, you should add this in the layer on top of activiti. In case of Activiti Explorer, you should edit the source, e.g.:
TaskDetailPanel line 359:
completeButton.setEnabled((isCurrentUserAssignee() || isCurrentUserOwner()) && myCustomCheckMethod());
In case of non-explorer usage, this can be added in the API/servcie that consumes activiti-API.
2. If you have "tasks" that aren't supposed to be completed by a human, the user-task isn't the right BPMN activity to use. Instead, use a "receive" task instead and the variables that you may want to pass to the process (like you do with the completeTask(task, vars)) can be done using runtimeService's setVariables(), before you notify the "receiveTask" to continue by signaling the workflow (also runtimeService).