Does every user on the domain need to install the our email migration app?

No, once the Google Workspace administrator installs the our email migration app, it will be available for all users on the domain. Each user will have to accept the permissions for Cloudasta before they use it for the first time.