Once an app is published to a stream by an administrator, users in that stream aren't able to access the script. I don't think there's an ability to hide parts of the script at this point in time. Similarly, objects and the expressions in them of published sheets can't be edited. Depending on the security rules in place users within the stream can duplicate a sheet and then access the expressions, but they effectively become content only for that individual unless/until published.
Does that help? I may be misunderstanding the context of your question.