SuperCreek
If you grant an app access to storage scopes (don't add folders or files, just turn it on), it actually doesn't have access to read anything except for the files the app itself creates.
If you want an app to only have access to specific files, you can just add the specific file to storage scopes.
Lastly, it's possible for an app to have access to media + storage scopes. Make sure the app doesn't have the "photos and videos" or "music and audio" permissions.