Need Clarification regarding Permission Scope XML 'AllowAppOnlyPolicy="true"'

Hello Everyone,

I am working on copying sharepoint files to blob via ADF through this https://docs.microsoft.com/en-us/azure/data-factory/connector-sharepoint-online-list?tabs=data-factory#prerequisites

Now this doc says (for giving service principal / app access to sharepoint site)

For Site Owner permission use

<AppPermissionRequests>
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/>
</AppPermissionRequests>

For Site Admin permission use

<AppPermissionRequests AllowAppOnlyPolicy="true">
    <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web" Right="Read"/>
</AppPermissionRequests>

Is this correct ?

As

The only difference between these two is 'AllowAppOnlyPolicy="true"'

According to another https://docs.microsoft.com/en-us/sharepoint/dev/sp-add-ins/authorization-and-authentication-of-sharepoint-add-ins

The reason we use  'AllowAppOnlyPolicy="true"' is so that the app works even when the user doesn't have access to sharepoint.

Our team was using the Site Owner XML to follow the least privilege principle but is unable to get data.[HttpFileFailedToRead , remote server returned an error : 403 forbidden error]

But if 'AllowAppOnlyPolicy="true"' will not give site admin role then we will use it [as our team do not have access to sharepoint].

We are cautious as the SPO site has some restricted content.

In short, I want to know what 'AllowAppOnlyPolicy="true"' does. Will it give site admin role or something else ?

Thank You