Hybrid Report Server and Service - Audit Use Case

Hi,

I work in an audit community and I have some questions and was wondering if someone could point me in the right direction.

We use PBI Report Server for reporting but the agency we audit has PBI cloud service. Since we are technically agency employees, we could use that too, but have not as of yet.

Conceivably, we could build data marts/flow PBI Service and report from there. This would work for a lot of audit projects, since we have entrance conferences and the agency knows what we are looking at broadly anyhow.

For investigative work, highly-sensitive data, or even planning work, this gets a little hairy. We obviously cannot expose this data to the agency. One great example is whistleblower data. We would never want that exposed, so that is the use case for Report Server.

I am just thinking we could use datamarts for regular/recurring data that we use for broad audit projects and we could (I think) connect to Service with PBI Desktop (RS Version) and publish the report to Report Server if we did not want the report exposed to agency personnel. Am I right on this?

If we were to go down this hybrid route, if we connect with PBI Desktop (RS version) to the PBI data mart/flow, what data/metadata actually gets exposed to the agency? 

Any help appreciated, thank you!