Does the report have to run as the user running the report?

If not then change the data source to use a generic account to run the queries, this is the easiest way.

If you do, you will need to look at a logon trigger that sniffs the application name of the app the user is using to connect (NOTE: this doesn't guarantee the user wont get in as app names can be spoofed) and only allow anything thats using the SSRS application name and where the username is in a particular list of users. You dont want to lock everyone out of using SSMS to query the server directly.