By default, there is a rule that allows everyone except anonymous users to export from Apps. If they have access to the App, they can export. You would need to disable this rule and build custom rules specifically for sheets an/or apps.
If you build rules at the sheet level, just remember that you be constantly changing this rule as new sheets are added.
The example I supplied is the default rule. You would want to disable this rule and create your own. For example, you could create a new rile called ExportAppDataCustom
The Basic section would have Export Data checkbox checked.
The Advanced section is where you build your rule. The Resource Filter would still be App_* but the conditions is where you build YOUR custom rule. I would build on what is there but you will need to add an AND clause specifying the name of the application and another AND to limit the user group.
Something like and (resource.name='Sales App') and (User.Group='Sales Group')
It's easer to control by group vs. individual users.
I can not build the specific rule for you, only you can do that. You should be able to find plenty of help in the online help (help.qlik.com).