Today, if you login to admin.powerapps.com/environments, you should be able to see:
1. Environments which you have created and owned
2. Environments which is shared to you (created by someone else)
3. Environments where you are user of D365 CRM instnace (with "System Administrator" role).
4. (may be more I might not have explored)
for point 3, if I am SystemAdministrator of D365 CRM instance then I can create Power app for that environment.
If I have to share once Power app is ready, then currently, I can share to either specified individual, or to all in the given Org. (D365 CRM org) or to specific User Group (if I have any)
It would have been ideal, if I could share PowerApp to all User(s) who have say "SalesManager" security role in D365 CRM. That way I can control access of PowerApp to only SalesManager and not to SalesPerson and I would need not to worry if people were added or removed from "SalesManager" Security Role.
Basically sharing PowerApp to specified CRM Persona's using CRM Security Role.