How do I restrict Users to access only specific Apps?

To restrict users to particular Apps (or Databases), split those resources into separate Environments.