Help: confusion with on-premises

Read this:

https://powerbi.microsoft.com/en-us/documentation/powerbi-refresh-data/

Then this:

https://powerbi.microsoft.com/en-us/documentation/powerbi-refresh-desktop-file-local-drive/

Then this:

https://powerbi.microsoft.com/en-us/documentation/powerbi-personal-gateway/

And maybe this one for good measure:

https://powerbi.microsoft.com/en-us/documentation/powerbi-refresh-desktop-file-onedrive/

Short answer is that if your data warehouse is "on-premises" then you will need a gateway. If it is a SSAS tabular model, then you have the option of the Analysis Services Connector:

https://powerbi.microsoft.com/en-us/documentation/powerbi-analysis-services-connector/

When running the personal gateway, the gateway runs under a particular user's credentials and it is that user that must have rights to the data source.

If you use the Analysis Services Connector and get it configured correctly, it will pass the credentials of the user from Azure to the cube so that the result set is trimmed per user.