Tim, on a Server environment no one can modify a published app, even the owner. Do you probably mean to add personal sheets on a published app? If you just want to avoid users to create sheets on published app, you need to modify the security rule "CreateObjectPublishedApp". By default anyone (except anonymous can do it), you should add in "AND" any condition you like.
Turns out it was a bug the whole time!
Qlik Communnity Post: Re: Allowing end users to create bookmarks on sheets
Qlik Support bug fix: Qlik Support
What I ended up doing was disabling the "CreateObjectPublishedApp" rule and creating a new one that looks like this:
And the conditions:
((resource.objectType="bookmark" or resource.objectType="snapshot" or resource.objectType="story" or resource.objectType="embeddedsnapshot" or resource.objectType="hiddenbookmark") and (user.name="user_name")) and resource.App.HasPrivilege("read")
Then I applied the bug fix, restarted the services, and everything works as expected.