In Thunkable Classic there was an extension to read phone number (and IMEI) so you can pair login data to phone number to prevent multiple access. IMHO, it’s the best way to do it! I don’t know if there is the same function in X, too.
I discourage you to use a logged flag as someone says. What about if app crash or close itself and the user try to login again from the same phone?