They need the manage permission for the ADS (so they can log into the main panel), and then the manage permission for the instance you want them to access.
For the game server management permissions, read through this guide:
https://discourse.cubecoders.com/t/managing-user-permissions-in-amp/2301
Then you need to port forward port 8080, or if you have a domain set up HTTPS:
https://discourse.cubecoders.com/t/setting-up-secure-http-https-with-amp/2305