Sorry, that's not currently possible in Qlik Sense. You need to publish the app used in a strem the user has access though, but there is no built-in support for access control to mashups. Basic anyone with access to the system can open the mashup, but they might not be able to open the app used, so there might be no data in it.
Erik Wetterberg https://extendingqlik.upper88.com/
He is not able to open the mashup i.e. extensions/mashup-name/mashup-name.html ?
When he is redirected to this Link, a pop up shows which asked for credentials. When i put up credetials it does not accept that credentials. I am sure about the credentials but i guess may be i am missing some step to allow user to see mashup. I can see the same link with my id(i.e. admin id).
Could be some problems with the app-location. Did you make the mash-up having the app in your own WORK ? Or did you publish the app to a stream (like EVERYONE, for testing purpose) before making the mashup?
Also try to select your stream in the QMC and Edit -> User Access and check if the user has the right rules