Which app do I need to allow for “Install unknown apps” — browser or file manager?

On current Android versions, you do not allow “the APK” itself. Instead, you always allow the app from which the installation is started. Android treats that app as the source. If you download the APK directly in the browser and tap it there, then your browser must be allowed. If you later open the same file through “Files” or another file manager, then the file manager becomes the relevant source instead.

That is why our recommendation is very simple: always allow exactly the app from which you are tapping the APK at that moment. A general, global permission for all unknown installations no longer exists on Android 8 and newer.