I'm new to salesforce and I'm trying to understand the security model for my managed app. The app needs access to custom objects/tabs and field access for some standard objects. The app would be used by a Sales manager like profile in any org and should not be visible to other users. I understand that a system admin can configure assigned apps for any profile.
My question is that If I only give permission to the sys admin profile and let him/her give permissions to the different profiles based on assigned apps. Would that be enough? Will there be any issues in accessing custom objects/pages/fields?
How do other custom apps package permissions and profiles? Do I need a custom profile or permission sets for my app? I do not have experience here, would appreciate any help.