Sometimes I send the apk via email, other times I give them the option to download from my web site. There I use credentials. For updates, I include in my apps an activity for downloading an update whenever one is available.
Of course, one can also use googlePlay, getJar or other sites.