try to create a new Power Apps environment without installing Dynamics 365 apps, do you see the Opportunity table? afaik you don't get that table as it comes with the 365 Sales applications.
the "complex" scenarios you mention is when you have a mix of licenses with an environment where the Dynamics 365 apps are installed.
Licensing is a tricky argument, because something you write today may not be valid tomorrow.
To my knowledge (and I repeat to my knowledge) an operation like qualifying a lead to an opportunity triggers MS logic intended for the Dynamics 365 apps, so the user performing it will require to have a Dynamics 365 license.
Let's say for example (and I repeat for example) that reading opportunity records is inside the bounds of the Power Apps license but creating not, a user with just Power Apps can read but cannot create new records and your security roles should reflect this. (I repeat again, this is an example, not backing a real scenario with my words, it may be true or not as today)
