Specific authorization for application registration

Dear Community,

When we assign a custom roles to a specific App Registration to one user, the user has the permission to all Microsoft Entra ID( Users, groups...).

How can we assign a permission only to a specific app registration.

PS: I set this option " Restrict access to Microsoft Entra administration portal" to yes.

thank you