For Visualforce Pages we could select security for which profile the page is available but looks like it is not possible to have the same functionality in Lightning for Lightning Apps.
If we try to remove permission from an object used in Lightning App we get internal error described here.
Maybe there is a standard way of doing that which doesn't lead to an internal error?
