This is a topic that is near and dear to my heart. (Direct answer is below) Specification pattern is agnostic. All it does is determine if the condition you define (specify) is met. It is useful in both places. I see two primary benefits of Specification: It names your business rules, and it hides (encpasulates) your implementation. Follow-on benefits are that you can lock down your repositories if you desire or supply an easily understood list of queries or rules.
Specification as applied to domain objects is slightly different than used as queries, but rather close. A "QuerySpecification" should have query language in it that the target repository implementation (EF) can take and execute in the database and return 0 or more matches.
Applied to domain objects, it's more often used to check if a specific object "meets the specification" or to filter applicable objects in a list (either to exclude or include). The usage looks different, or it's a different aspect of the same concept.
I respectfully disagree with Zoran's suggestion. Returning IQueryable means you're giving application code (possibly someone else's application) the ability to directly query against your data store. Lazy vs Eager loading becomes a real tangle, too. You lose encapsulation and also implementation isolation, I think.
Remember also that EF represents an implementation of Repository and UnitOfWork. DbContext is the Unit of Work, while DbSet is a repository. Your goal in applying your own DDD interfaces is to make sure your domain does not depend on the EF Implementation, so your integration code there should be quite small.
So, direct answer.
I would suggest adding a method to your Repository interface that accepts IQuerySpecification and returns T. Your actual specifications are part of your domain. These are the rules for the combinations of data your organization needs. You could put them in a "shared kernel" (library), or have them reside in your application depending on your needs.
Note that ideally, by using the query specification, you can eliminate all the special purpose repository functions that often pop up because Specification separates the the thing being queried from the query. Eric Evans wrote it better:
The central idea of Specification is to separate the statement of how
to match a candidate, from the candidate object that it is matched
against. As well as its usefulness in selection, it is also valuable
for validation and for building to order
(https://www.martinfowler.com/apsupp/spec.pdf)
See also https://matt.berther.io/2005/03/25/the-specification-pattern-a-primer/