We are using PowerApps in the Enterprise, which requires basic security. When sharing an app to users, they also have access to the data connection that the app uses. This allows them to create their own app and view un-filtered data using that connection.
The expected behavior is to share an app, but not allow the user access to use the data connection to create their own app.
Please consider remove the user out of the Environment Admin or Environment Maker group.
If the App is only shared to the User with Can use level, and the user is not a member of the Environment Admin or Environment Maker in the proper Environment, then the user should not be able to create new Apps in the corresponding environment.
Please check the following article for more details: