Which app do I need to allow under “Install unknown apps”, the browser or the file manager?

On current Android versions, you do not allow “the APK” itself. You always allow the app from which the installation is started. Android treats that app as the source. If you download the APK directly in your browser and tap it there, your browser must be allowed. If you later open the same file through “Files” or another file manager, then the file manager becomes the relevant source instead.

Our recommendation is very simple: always allow the exact app from which you are tapping the APK at that moment. There is no longer a general, global permission for all unknown installations on Android 8 and later.