Yes, the maps have to be public. The application doesn't have any built-in way to authenticate users. It's a good idea, but just not implemented. You could probably download and customize the app, and deploy it to your own web server.
I deleted my previous post because it was wrong...
The answer currently is that the web maps must be public to use one of the gallery templates and publish it to ArcGIS Online. However, with a bit of programming, you should be able to download the template application and modify it. You will need to explicitly add a sign in option to the gallery application, then you should see the web maps shared with the group.