Publishing the app without everyone having administrative access?

I’ve built my app and want to roll it out. I assume the only way to “publish” it is by sharing a private link or scanning the QR code then saving the URL to the homescreen as an “app”. Surely this isn’t the only way to share the app. What am I missing?
Also, everyone who “downloads”/saves the app has administrative access and can edit everything. How is this possible? Is there a setting that restricts random using from editing the app info?

Thanks!

Users can access the features you make available to them. For this reason, it’s common to make a separate admin app with access to the same sheet for admin users.

Is there an easier way of downloading the app other than opening it in Safari first, then saving to homepage?

No, that is the only way.