I'm still not sure I understand what you're asking, but I'll try to answer based on what I believe I understand.
I think that you're asking whether you can limit the functionality of an application you've installed from the AppExchange to only access specific data. The answer to that question is generally no. Application code runs in the context of the user who is logged in, and accesses data that is visible to that user. There's no mechanism to scope visibility of data in the org by namespace (application).
If all users of the application fall within specific positions in your role hierarchy and share a Profile, you can apply standard Salesforce security mechanisms to the users (not the application) to limit their visibility.
In most cases, application code should respect user-level record visibility. However, backend functionality like triggers may choose to ignore sharing rules and FLS in specific situations in order to ensure data integrity.
If the application is hosted off-platform and is accessing your Salesforce data over the API, you can permission the user as whom the application connects to limit its visibility in the same way as you would any of your "real" users.