Rolling back a bit. You create a Microsoft Forms form for users to fill out with their leave request. You create a flow to run when a new form response is submitted and have it create an item in the Leave Requests (SharePoint) list. When that runs, it will run using the SharePoint connection you define in the flow (typically your own account or a service account if you have one); it cannot run as the person who submitted the form. So, assuming you use your own account/SharePoint connection, all of those list items will be "Created by" you. In this case, forget about the "Item Level Permissions" settings - they won't help you.
You want each user to only see their own items, so you could use the Grant permissions action to give the submitter of the form View access to the item that was created. However, that gives them permission to the item, but not the list. If they don't have some type of access to the list itself, they won't be able to "get to" their item. So, you would need to give them "Read" permission to the list. However, as you pointed out, that does give them the ability to read other user's items. The way to prevent this is to (before granting permission), use the "Stop sharing an item or file" action. This breaks the inherited permissions, so you then need to grant permissions to those who need it. The "permissions" part of the flow would be:
- Create item
- Stop sharing item
- Grant form creator view access to item
- (if needed) Grant other permissions as needed (for example, how is "approval" being done? Will another person - the manager, maybe, need edit permission to the item?)
Again, even without the complication of a Power App, I think you need to clearly lay out and define your process so that you can identify exactly who is going to be involved and determine what permissions people will need to to the Leave Request items. A lot of people think "oh, the manager is going to approve, so they need edit permission to the item" when in reality, they don't. If the "approval" process is running as you (or, again, a service account) that has site collection admin access, then the manager does not need any access to the item (assuming you include the relevant details about the request in the approval message). Also, you're saying that the user shouldn't be able to edit their item. What happens if they need to change or cancel a leave request? It will happen, so you need to know how to address that.
Maybe you have already defined all those specs and requirements, but based on the questions you're asking, I think you may have overlooked some details. I'm not trying to make things more difficult for you, but it sounds like you may need to more clearly define your process and requirements. It's not an easy process, but it is necessary.
