PowerBI Embed in Web Application for Organization without giving user access to Workspace

we are using below code:

public string GetAccessToken()
{
return this.tokenAcquisition.GetAccessTokenForUserAsync(RequiredScopes).Result;
}

public PowerBIClient GetPowerBiClient()
{
var tokenCredentials = new TokenCredentials(GetAccessToken(), "Bearer");
return new PowerBIClient(new Uri(urlPowerBiServiceApiRoot), tokenCredentials);
}

public async Task<EmbeddedPowerBIReport> GetReport(Guid WorkspaceId, Guid ReportId)
{
PowerBIClient pbiClient = GetPowerBiClient();

// call to Power BI Service API to get embedding data
var report = await pbiClient.Reports.GetReportAsync(WorkspaceId, ReportId);

// return report embedding data to caller
return new EmbeddedPowerBIReport
{
Id = report.Id.ToString(),
EmbedUrl = report.EmbedUrl,
Name = report.Name,
Token = GetAccessToken(),
StatusMessage = "Success",
StatusSuccess = string.IsNullOrEmpty(report.DatasetId) ? false : true
};
}

In above code snippet, if we don't give workspace level permission to user they are getting error saying "Microsoft.Rest.HttpOperationException: Operation returned an invalid status code 'Unauthorized'\r\n   at Microsoft.PowerBI.Api.ReportsOperations.GetReportInGroupWithHttpMessagesAsync(Guid groupId, Guid reportId, Dictionary`2 customHeaders, CancellationToken cancellationToken)\r\n   at Microsoft.PowerBI.Api.ReportsOperationsExtensions.GetReportInGroupAsync(IReportsOperations operations, Guid groupId, Guid reportId, CancellationToken cancellationToken)"

But when we give user permission to workspace as viewere they are able to load report on web pages as embedded report. 

In all cases, i have make sure they have access at report level and workspace level. we just want to make sure users wont be able to see other report in workspace if they navigate through msit.powerbi.com