How can I make a flash drive with a portable app that runs without admin permission?
You can run an App no matter where it is located - even on a write protected volume unless the app is severely non-standard and attempts to write to the application directory or self-modify itself.

Are you certain that there are not some other form of managed preferences or parental controls enabled that is restricting non-whitelisted apps?