Answer
Combine App of Apps (or ApplicationSets) with AppProjects and RBAC: each team's child apps belong to their project, which restricts destinations and sources, and RBAC scopes their permissions to that project. Teams manage their apps via PRs without affecting others.
Real-world example Team B owns its child apps within the team-b project, unable to deploy outside its namespaces or touch team A's apps.