Hi Tracy,
I think this suggestion would indeed give you what you're looking for. This would give the app access to all of the data, but prevent any referrer besides the app accessing it:
"A solution that doesn't scale as well (this option does not take advantage of the CDN which enables ArcGIS Online apps to handle millions of hits) is to add the secure hosted feature service URL (or view) back to ArcGIS Online with stored credentials. Then you can limit usage to specific application URLs as explained in the documentation linked below. This option should be only pursued for an application with a moderately small audience. "
All content is within our ArcGIS organization, and traffic from arcgis.com is not something you can limit, correct?
>This is correct. This is why going through the above configuration steps is necessary. It will give the new item the URL "utility.arcgis.com...", in a similar way as adding ArcGIS Enterprise services to ArcGIS Online and storing credentials.
Once you have the above configuration set up, this dialog is exposed on the settings page:
Please keep in mind that this does not take advantage of ArcGIS Online's scaling technology and should not be used for a large audience.
Thanks,
-Peter