How secure is my client's data when establishing a gateway to PowerBI's online service?

Hi there By default when your client shares a dashboard or report it can only be access in Read-Only mode. The best advise is to share the data using an App from an App Workspace. this will ensure that the data can only ever be read-only to the people who access the App. Then people who need more access to create dashboards or reports would need to be added into the App Workspace as members with the required member permissions.