IAP allows you to protect apps on AppEngine by defining which principal has access using roles/iap.httpsResourceAccessor. If I have a group in IAM called participants and I add external people (personal gmail accounts & contractors) to that group, will these people have access to my application?
Or do I have to submit the application for verification even though I want to limit the access to our employees and a few dozen customers taking part in a workshop?
So in other words, does IAP define "people in your organisation" as people who have a @myorg.com email address only or as people who are part of a group that has IAM permission?
"People in your organization" are users who have been granted permission in your Google Cloud Project or Organization. This includes @gmail.com accounts, which can have roles granted and can be added to groups.
For an internal application you do not need to verify the app, but you will need an internal OAuth page.
You can find more information in this documentation.