Basically you are adding code at the start of your app that is identified as Section Access. You are either loading an InLine table or accessing an external file that contains the Userid, type of access, and what you want to have them to see or exclude.
The syntax is very specific.
The Qlik help file is useful. But a real life example is always better. At least for me.
This is loading the values to determine the user access to the data displayed in the app.
(ooxml, embedded labels, table is Access);
Then you include this line at the start of the script that generates the data for the app:
Hope that helps some.