How to limit viewer role to just one app

[MaggieT]

I have an Experience Builder App. I have an organization member with a member type of viewer. I need that member to be able to see that one Experience Builder App only. Can this be done?

They cannot see the rest of the organization's content, and I've seen some answers to similar questions that lead to that.

[AustinAverill]

AFAIK, there is no way to limit a Viewer's access to the ExB application solely. All of the underlying content that is shared to their group will also be visible if they were to login directly to AGOL. 

To mitigate this, I like to create either HubSites or an Experience that links directly to the assets that a certain individual should be access and let that be their "app portal." Hub Sites are cool for this since you can condition visibility on Role/Group Member ship if you want to have a singular central site for everything.

[MicZatorsky_AEC]

Create a group and share only that one app, and add the user.  This will limit that user to that one app.
As for the data in the app, you will have to share it with the group too.

Create a custom role that has permission to see only the content shared with groups and not items shared with the organization.  This prevents them from seeing anything not explicitly shared with their groups.