Okay, here's my current methodology for creating WAB apps.
1. Publish ArcGIS Server service(s) to ArcGIS Server (local).
2. Create web map on ArcGIS Online that uses the service(s) from step 1.
3. Use the Web Appbuilder (dev version) to create a web app that uses the web map from step 2.
4. Download the WAB app and deploy it on my local web server.
So, up until now, this has worked fairly well for us. The problem comes when I want to restrict access to resources published in a particular web map (until now, everything I've deployed via WAB has been publicly accessible). I have tried setting the "sharing" option in ArcGIS Online for the web map to specific ArcGIS Online "groups". I can get this to work only after registering the locally-served app with ArcGIS Online and editing the config.json to include the "appId" generated after this registration process (otherwise, I get errors when attempting to login -see bug description below).
The problem I am coming across is that I am limited by the number of logins/users/seats/etc we have as an "Organization" within ArcGIS Online. So, let's say I want to be able to share my app with 50 members of my organization. Then I need to have 50 logins to my "Organization" in ArcGIS Online. I guess I don't understand why this is the case. I mean, I'm hosting the ArcGIS Server services (ie the data) locally and hosting the web app locally, so why do I need 50 logins just to be able to share my app with my colleagues? Maybe I am missing something here. Can someone please enlighten me if so?
*We are using Enterprise Logins in ArcGIS Online, so it's possible that the part where I have to register the downloaded WAB app is a result of that, as per the bug below (from ESRI):
Defect ID: BUG-000099402
Synopsis: Specifying credentials for an ArcGIS Online enterprise account to access applications created using Web AppBuilder for ArcGIS (Developer Edition) returns the following error, "The username or password you entered is incorrect."
Status: Not in Current Product Plan
Workaround: Use a built-in ArcGIS Online account when signing in to access the web application.
Public Explanation: For supporting OAuth or SAML login, the app needs to be registered and add the appid to config.json file. The guide is documented in readme.html file in the downloaded app, and the developers site: https://developers.arcgis.com/web-appbuilder/guide/xt-deploy-app.htm#LI_D74BFE27BEA64CF19D1667B5E88E646C