i do not understand your solution you create with a security role a user role "Content Admin" that is only working for a special user. Makes for me no sense. With this approach the user will see all content and notjust his streams and related apps. Its quite the same just giving the user the user role "Content Admin", but this is not the case here.
3. Go to users and under Role, you'll find CustomContentAdmin. Add this new role to the user and also you can add the same Custom property to the Apps or Streams etc... But I believe only Role will be enough.