Submitting the application is all about moving it to another instance so that doesn't affect who can access the app in your current instance. You should be able to use the workspace security settings to limit who can access the workspace within your PDI.

If this is an experience you're planning on deploying eventually to a production environment, you should really be working on the development in the development instance associated with that production environment. If not you'll likely run into some scoping issues. The purpose of PDIs is learning and testing.