How to receive app mentions only from a channel, while having the consent to read user messages?

The two behaviors cannot currently be separated with that RSC permission. Microsoft documents that ChannelMessage.Read.Group lets a bot receive channel messages even when it is not mentioned. It is also the least-privileged application permission for reading that team’s channel messages and replies through Graph.
ChannelMessage.Read.All grants organization-wide application access. Microsoft does not document a Teams application access policy that narrows it to selected teams or channels, so it is unsuitable when team-level isolation is mandatory.
The supported least-privilege design is to install the app only in intended teams, request ChannelMessage.Read.Group there, and discard non-mention activities before expensive processing. When mentioned, use the team, channel, and root-message identifiers to fetch only that thread’s replies. Avoid storing unrelated message bodies and explain the behavior to the consenting owner. If mention-only delivery is absolute, omit RSC; the bot then cannot app-only read unmentioned thread history. Delegated access would be a different, user-dependent design