When installing apps from the Google Play Store, you're fairly safe since apps are verified by Google before being made available. Google also has a feature called Google Play Protect, which scans your device for malicious apps, including third party apps, and malicious activity.
Of course, there are a few exceptions to this rule, like the recent indicident where hundreds of malicious apps infected the Google Play Store.
When installing an app directly from the APK, there is a higher risk of the APK containing malware since you give Android permission to install any third party application. Some things to consider to make sure the APK is safe:
Upload the APK to VirusTotal and scan it for issues including malware.
Scan the APK with NViso ApkScan and get a detailed report of the file.
Decompile the Java source code and examine exactly what it's doing. There's a guide on how you can do this here.
Look at the permissions the app is asking for and determine whether they look suspicious. Here are some permissions which may raise suspicions (taken from here):
See more on permissions here.
Make sure the app signature is valid. There's already an answer on Stack Exchange which explains how to make sure the signature is valid.
Avoid Third Parties
Don't install apps from third parties at all. It's much safer to get apps from genuine sources like Google Play Store where the apps are already scanned.
If there is a version of the app on the Play Store, after installing the APK you can check the app on the Play Store and if there is an option to update the app due to the APK being old, this would suggest that the APK is genuine.