User access allows the user to play the app, they cannot edit the canvas app but if they have appropriate permissions on the SP list, they will be able to create/update records in the SP list based on the functionality in the application.
If this reply has answered your question or solved your issue, please mark this question as answered. Answered questions helps users in the future who may have the same issue or question quickly find a resolution via search. If you liked my response, please consider giving it a thumbs up. THANKS!