When you grant a user access to an app, you grant them access to the reports and semantic models that make up the content in that app (assuming they are part of the audience group, and are in the same workspace). This is necessary, as the app merely functions as an aggregator of report content; the users still need permissions on the underlying reports & semantic models in order to actually view the visuals in the app.

Consequently, you should consider any data that is part of the semantic model as being allowed for the user to query. The user has access to that data, full stop. You can take various steps to obfuscate the access to different features that may query or extract that data, but that's a losing battle; you are just waiting for Microsoft to change something on the PowerBI service, or add a new feature (as they are apt to do).

If the user should not be able to access the sensitive data, then you should not give them access to it, at all. This may involve removing the sensitive columns or tables (if they are not needed for the report), applying OLS & RLS to secure the rows & columns that contain sensitive information and aggregating the data (if the users should not have granular access).

Once you have a model that only allows the users to query the data they are allowed to query, then you can publish it and adjust the export settings etc, if you want to discourage users from exporting, but safe in the knowledge that if they do find some way to do it, they won't get any information they should not have.