We give datareader access on the read-only reporting db to some staff who need to run ad-hoc queries. None of our business logic is in the database (Views, stored proces, etc) - So execute rights is probably not applicable.

Setting up a roll to view specific tables (just over 1000 - 1 schema) can be a bit tedious, but after Steve's post it makes a bit more sense - Will investigate a bit further now...