You need to make sure you set security at the level you want the user to see. If a user has Browse permissions at the report server level they will be able to see everything, but you can set permissions on each item (folder, report, data source) and users will only see what you grant them permission to.

Also you can objects to be hidden in tile view (the default view in Report Manager) and unless a user chooses to click on Details View they won't see the objects. My experience is that most users don't care about Details View so they'll never see things that are "hidden"