Not finding any real answer to this question, so not sure if I am articulating my question correctly...
I am creating an college registration form for students using a SharePoint-hosted Add-in. Requirements make it thus and MUST be all self contained rather than split up (cross-domain). Therefore, lists and libraries are created by the add-in when deployed. Students are able to register and add documents just fine.
The problem I am seeing is that if a student happens to know the direct URL to the list or library, instead of using the GUI design, he/she would then be able to view/edit all the other student records and personal information.
CAVEAT: There might be certain people who will need to access these lists directly to "Open with Explorer".