In my opinion, both option 2) and 3) can be considered. For option 2), since you want to grant users to access report server, you should add them to a system-level role and item-level role. You could refer to the document: https://msdn.microsoft.com/en-us/ms156034.aspx?. In my environment, other users can access report server from other server though we doesn't take any actin in firewall.

For option 3), subscription can delivery report by sending emails or Windows share file to users, with multiple render format. You can create a subscription with once or schedule.