This is not possible for a public app, as AFAIK the read_users scope is still limited to custom apps even though some of the docs indicate otherwise. The current workaround is to use online access tokens, but that only works for staff users who have actually accessed the app.
See these threads for more details: