It will depend on the type of data being access and your company's security requirements/policy. In general you do not want users sharing an account, especially if that account has more than read permissions on your database. I would verify with your security folks or legal group if there are any specific requirements for managing access to data, or with auditing. If you fall under any industry standards like HIPPA or PCI they have controls that require being able to map access to a particular user.
With regards to how you allow users to run reports that is usually driven by policy where I have worked. Do you experience any performance issues now with how they are pulling reports and "peak" at data? As a DBA, I'm a control freak to a certain degree, I like to know who and what is making calls to my data. I have been in one environment where reports were pointed to a database snapshot of the production database, so their was less of a performance concern. Another environment it was not until their report caused a performance issue in production that we would tell them if you want that information run it after business hours.
