AppImages can be started as binary executables (set exec permission for that).

They do not provide desktop files, however some desktop environment allow to put a link to application to their desktop. This creates adesktop file that can be customized.

An other issue is that some AppImage require root permission. Desktop environment might handle this and ask for the root authentication (password or FIDO)

To run them in the firejail sandbox as when they want root permission do firejail --noprofile ./<name>.AppImage

the option --noprofile deselect the default profile

--net=none would turn net off

~/.config/firejail/<name>.profile can creates a profile

./<name>.AppImage --appimage-extract creates a squashfs-root folder that holds the files from the AppImage.

./squashfs-root/AppRun will then run it