@kuchar71 Without giving them access to the list, the only way you can do it is by creating a sub-flow.
Basically you set it up like this: The app calls a flow which then has an HTTP call to an endpoint of another flow.
In this second flow you will create the calls to SharePoint.
The first flow will be run as the user (with their permissions) who is currently using the app but the second flow will be run with the account of whoever created the flow (assuming yours) therefore you only need to allow that user access to the list and not anyone else.
If this answer is helpful then please consider marking it as a solution to help other users in the future.
Sam