Support with Workspaces, Apps and Reports

Looking for some suggestions and help about how to manage Workspaces and Apps...

I find myself creating many Workspaces as a means of restricting access to Reports within the App.

The ideal solution would allow me to have a single App, where the Reports within would be restricted from view or access.  In other words, I would like to create 1 App with 10 Reports, and have the ability to pewrmit access to the reports by specific users.   i.e. Mary is a manger, has access to 10/10 reports.  Joe, as a staff member, has access to 5/10 reports - and so on.

This would allow me to have everyone participate in a single Workspace and App, while seeing only the reports I as the admin. allow.  I find it less than ideal to have people, manages for example, to access mutiple Apps in a highly-matrixed organization where subject matter needs to be governed.

What am I missing?

Thanks.