Well, first of all, bounce rate is a vanity metric. It's rarely useful and it's very easy to misuse. Mostly because of all kinds of the bots bloating it up with no cookie persistence. It's also usually not used by senior analysts because it's much more useful to build channel-, campaign-, and conversion path-specific funnels and address them separately than just to look at unpainted raw bounce rate. But then once you have those funnels in place, you will never care about the general bounce rate because it will become the drop-off or abandonment rate, which can be analyzed and addressed properly.
Now back to your question. You don't need to filter anything out. What you need to do is to make sure that app.example.com sends proper tracking calls to the collect endpoint. They should have the same tid (tracking id), cid (client id) and sid (session id) parameters as the calls from the www.example.com. If that's the case, then what you've described can't contribute to the bounce rate. Read more on the definition of what bounce rate is here, but generally, it's a bounce if:
- There's less than 2 screenviews/pageviews in the session
- The user spent less than 10 seconds on the page
- There were no key events
Even if you neglect to track the clicks on the log in CTA as a key event, you still should get the pageview event from the app page with the same tid,cid, and sid. If any of the ids is different, then you need to fix it.