Explanation:

According to the Microsoft SC-300: Identity and Access Administrator Study Guide and Microsoft Learn module "Implement and manage Application Proxy for on-premises apps", Azure AD Application Proxy requires that the connector installation be performed by a user with either the Global Administrator or Application Administrator or Cloud Application Administrator role.
The Application Proxy connector must be installed by a user who can register and manage applications in Azure AD. The documentation specifies that both Application Administrator and Cloud Application Administrator roles can perform Application Proxy connector installation. Since the question requires adherence to the principle of least privilege, Admin3 (Cloud Application Administrator) is the most appropriate user - because this role grants the required permissions without the broader rights of the Global Administrator.
"Cloud Application Administrator can create, manage, and delegate enterprise applications and Application Proxy connectors, without tenant-wide permissions."
# Therefore, Admin3 should perform the installation.
After the connector is installed, User1 needs to register App1 in Azure AD. The role required to register and configure application registrations is the Application Developer role.
According to Microsoft documentation:
"Users assigned the Application Developer role can register applications in Azure AD and manage app registrations they own." This role is the least privileged role that allows creating new application registrations, unlike Application Administrator or Cloud Application Administrator, which can manage all apps tenant-wide.
# Therefore, assign User1 the role of Application Developer.