You package an internal accounting tool as a Win32 (.intunewin) app and upload it to Microsoft Intune. Finance staff should be able to choose whether and when to install it themselves from the Company Portal, but the app must not be pushed automatically to their devices. All finance users are members of an Entra ID group named 'Finance-Users'. How should you configure the app assignment to meet this requirement?