Just to clarify:

This means that the users accessing the URL must have permissions on the server

This means that they have URL access through SSRS permissions for the main page, not setting up permissions on the actual server. Sorry for any confusion.