As stated in documentation ( https://github.com/it-projects-llc/access-addons/blob/12.0/access_apps/doc/index.rst ) if you choose to Select blank line in Apps access security category, then User can't install apps from anywhere. But, if we go to module's Configuration (e.g Website's configuration), we can see Apps menu item which in my opinion is wrong.
Want to back this issue? Post a bounty on it! We accept bounties via Bountysource.