Hi @dilman,
Would you please explain a bit for "I don't want to remove them from the environment."?
If you would like the user not be able to create App in the environments, then you may remove the user from the Environment Admin and the Environment Maker, only share the App (set with Can use permission) created in the Environments with the user.
Doing in this way would have those users only be able to use the App shared with them, but have no rights to create new app in the corresponding Environments.
For now, permission configured through the environments have two roles:
Environment Admin, Environment Maker.
Please check the Manage security for your environments part in the following article for more details:
Environments administration in PowerApps
"
The Environment Maker role can create resources within an environment including apps, connections, custom connectors, gateways, and flows using Microsoft Flow. Environment Makers can also distribute the apps they build in an environment to other users in your organization. They can share the app with individual users, security groups, or all users in the organization. For more information, see Share an app in PowerApps.
"
Regards,
Michael
