There is currently not a unique user identifier sent from Central to Collect that can be used for this kind of filtering. Part of the reason why is that Collect doesn't currently guarantee that a username pulled by the form matches the server username unless Collect has its admin settings locked down (https://docs.getodk.org/collect-settings/#user-settings).
The only completely hidden way to do this is to use deviceid. This is an identifier that is generated by Collect at install time and uniquely identifies an installation. It is reset if the app is uninstalled and reinstalled.
You can access deviceid in an XLSForm by using type deviceid: https://docs.getodk.org/form-question-types/#metadata
What some people do is have a form that asks for a name and other identifier and accesses the deviceid. Filling out this form and submitting it makes the deviceid available to a project manager.
Another popular approach is to have an identifying question in the form. Depending on the level of sensitivity of the data you're working with, you can approach this in different ways. For example, you could simply have a dropdown of different users and trust them to select the correct one. If you have more sensitive data, you could assign each user a passcode that only they know and have them enter it every time. You can see the latter demonstrated in these sample forms shared for the Collect offline Entities beta:
These use an entity list to manage enumerators and their PINs. You could also use a CSV.
If users have devices older than Android 12 and have the Files app, they could view the full entity list as a CSV. If your data is highly sensitive, we recommend making sure as few apps as possible are installed on devices and preventing app downloads.