How do [ECR policies](https://docs.aws.amazon.com/AmazonECR/latest/userguide/RepositoryPolicies.html) differ from IAM policies?

The language around the ECR policies seem to indicate it is similar to the S3 bucket policy.

Does it allow you to grant access not using IAM?

If I wanted to grant another account access to registry can I use an ECR policy or do I still need a cross account role?