The only official way to get the production application is through the Google Play Store. For support purposes, we have a debug APK that we may provide you to sideload but it is only valid for 30 days before it has to be reset.
Most MDM solutions provide a mechanism to install applications from the Play Store, even when that is disabled for the users on their device. For MaaS360 as an example, this is how you would do it: https://www.ibm.com/docs/en/maas360?topic=catalog-adding-public-app-android . Similar concepts exists for Intune, AirWatch, and many others.
I have heard of some specific solutions that require an APK file. There are ways in Android to retrieve the APK file from the device today and it's not possible for us to prevent it. But it is not something we officially support.
------------------------------
Steven Shull
------------------------------