We recommend that you install the package to Administrators Only. You'll be able to assign different roles a bit later in the process.
During the installation, you'll be prompted to allow the package to call https://api.cym-identity.com.
As of version 0.7, the only API called from the package is to acquire Public/Private keys used for the Realm JWKS since there isn't a native apex function / method to generate them.
You can delegate the administration to other people from your organization. All you need to do is to assign the cym-identity admin permission set to the appropriate users.
The installed package also comes with a Lighting app CYM-Identity App which has all the components required to administrate your setup.
We will assume that you are using this App for the remaining of the guides.