Embedded api permissions with tenant.read.all

Looking to embedd (app owns data) using authentication through an existing app registration.

Want to grant tenant.read.all for Power BI in the api permissions. The admins have some concerns:

Would this grant admin access to read everything in the tenant?

Or would I still need to share the application to the workspaces?

Ideally they do not want to grant admin (read) consent to all datasets in the tenant, but prefer to go the SP with the existing app.

Thanks