Give the user select rights on the tables and execute rights on the procedures. It will work exactly as you want. They'll be able to only select directly from the tables, but when they run a proc whatever that proc does will work, providing the procedures don't use dynamic SQL.