Contact sync

Hi together, 

i got some questions.

We are using Intue for iOS Deployment. Now we can install via CompanyPortal (VPP), CompanyPortal (App-Store) or directly through the App Store. Example Whatsapp.

All three Apps can have access to the Contacts. But we dont want to give these Apps access to the Contacts in the Addressbook.

How can i set this up?

When is a App Managed? If it is from Microsoft, or when its installed over the Company Portal via VPP or over Company Portal via Store? 

I dont get it.

I think i can resolve the problem here but it will not work for me.

Has someone advice?