PowerBI Desktop access to PII

I have a set of report writers that need to use PowerBI desktop to create the reports but this data contains PII.

Normally we don't allow end-user devices/laptops to access this data directly (or even host it) and any administration or analytics would normally go via a management/BI plaform. While we could do something like this, the report writers are not going to thank me if we force them via a brokerage layer.

What have other done?  how do you allow access to the PII without exposing the database to the whole of our userbase and then how to you secure the data once it is on the device