postgresql materialized views vs versioning
You can create a function with security definer owned by the MVIEW owner that does the refresh and then grant execute privilege on the function (or procedure) to your app user.