Is the issue that you don't want to replace an app in a stream? You don't need to delete the old app. Make a duplicate that you own but is not published. Publish this app to the stream with your security rule. When you make changes to the unpublished app, click publish and check the replace check box. This will replace the version you specify from the list of apps.
Giving multiple users access to an unpublished app is not supported because of potential locking issues with updating content / refreshes.
Should remain the same as the app being published. So the duplicate that you are creating is going to be the guid you will want to use for your binary loads. As you publish, that guid will still be the same.