There is actually no OAuth 2 scope that allow only subdirectory access. App developers can either get full access, per-file access with a file picker or Application data folder access. Using Application data folder would seem to be the right choice but there is one problem: you cannot access Application data folder through Google Drive apps. Only the OAuth 2 application can access that folder. You can delete it in your Google Drive settings but you cannot see the actual files.