Transimpex, following on from what GustavBrock posted,
- When licensing Microsoft Office 365 for use with Remote Desktop or RemoteApp, your users need to be licensed for a subscription that includes Shared Computer Activation, such as Microsoft 365 Business Premium. See https://docs.microsoft.com/en-us/deployoffice/overview-shared-computer-activation. You must also install Office 365 or the Access Runtime using ODT and configure your XML configuration file to use Shared Computer Activation. On top of Office 365 costs, you also need Windows RDS User or Device CALs and Windows User or Device CALs suitable for 2019 or whatever version you're installing (though you likely already have the Windows CALs).
- To prevent users from changing the VBA code in your database file, save it out to an accde file so that the VBA code is compiled and the source code is removed... then as suggested by GustavBrock, rename that file to accdr to ensure that if the file is opened by the full version of Access rather than the runtime, the database will run as if it was opened by the runtime. This doesn't prevent users from seeing your local and linked tables or changing the contents of them directly, but it does prevent a malicious actor from adding code that damages your systems, removing password checks, taking a look at your hard-coded passwords or password tables, stealing your source code, etc.