Since Android 8.0 the platform replaced the old global Unknown sources toggle with a per-application permission. Most guides you will find still describe the old behaviour, so it is worth understanding the change.
The permission is held by the app that launches the installer — normally your file manager or browser — not by the APK itself. Turning it on lets that one app hand packages to Android's package installer. It does not let arbitrary apps install themselves silently, and it does not bypass any other check.
Return to the same screen and switch it off. The app keeps no residual ability to install packages afterwards. Doing this after each install costs a few seconds and is worth it — while granted, this permission is the widest single gap you open in the device's normal security posture.
Android 7.1 and earlier use a single device-wide switch under Settings, Security, Unknown sources. Some manufacturers keep a similar master switch alongside the per-app one — if a file manager has permission but the install still fails, check both.
Even with this permission granted, Play Protect continues to scan sideloaded packages before and after installation. It is independent of this setting and does not need disabling for sideloading to work. If an installer asks you to turn Play Protect off, treat that as a reason not to continue.