Workspace Permissions and app

Hi Power bi users 🙂 , I'm going to development an app with two differents groups user's inside one workspace, e.g.- Report A -> Group A,  Report B -> Group B (requirement).

I understand if you grant access to workspace a group A , they'll show all reports in workspace 😞 , but if you define audiences in app should be not access.

The documentation says: ". An app can have permissions that are different than the permissions set on a workspace. This capability makes it easier for designers to manage permissions on an app."

So what is the rule to permissions than I  should be apply to the requirement? permissions through the app and disable access to workspace?

It confuses me.

thanks.