Robert,
If I had deployed an app using above methods. Will the app open for those people whom don't have access to the webmap.
I believe if an user tries to open an app from WAB directly and if it doesn't have access he cannot open the app .
I am wondering if the same will happen if we deploy the app in IIS ?