You may have already seen this, but here’s a user level access matrix you might find handy:
Based on this chart, it does appear that a user would need to have one of these types of access, that I outlined in red. I do not know a way for a user to view reports without having the appropriate permissions. I’m hoping someone else can chime in if they know.