We did this with Proxy Authorization. That's where you connect to the database with one user, but you can assume the authorization rights of another user for specific purposes.
So your app would have to connect with a user's individual ID, but then you'd issue 'set proxy myLogin' to give them rights to run the reports and access those database tables. If they ever connect outside your application (with Crystal Reports or some other 3rd party tool), they'd be connecting as their unique login and wouldn't have rights to the underlying database tables unless they also knew to issue the 'set proxy myLogin' command.