@MrCMG as a minimum they need Contribute permissions on the SharePoint list. But if you've built this as a standalone Power App you don't need to tell them which site the list is on or what the list is called, they just interact with it in the app via galleries, edit forms or data tables. It's not foolproof but it's an approach we take all the time at my company. If you've done it as a PowerApps customised form then that's something different and you wouldn't be able to prevent them directly accessing the list.
Rob Los Gallardos Intranet, SharePoint and Power Platform Manager (and classic 1967 Morris Traveller driver)