Indeed, pooling is only for fees.
Inner transactions can only come from the application account* and cannot come from the sender.
You need the sender to send tokens to the application account beforehand if you need to use those.
*Note: technically it’s any account authorized by the application account, which is the application account itself and any account rekeyed to it.