it is strange that your user is able to access an app that he/she does not actually have a license for - should be impossible.
Anyway - look up the Section_Access. You can give ADMIN or USER access to an app to specific users, e.g. using their NTNAME (PC logon) - other persons that you haven't specified there will not be able to open the app, although they might have a license for it.
yes, it is possible. I couldn't find it right now, but there is a checkbox somewhere in the QMC - or maybe in the document_properties - to "restrict visibility based on Section_Access". That means that persons who you haven't specified in your SA to have access to the document cannot see it on AccessPoint.