@Anonymous My personal opion is that workspaces aren't the dumping ground for reports. For the exact reason you outline, not only are you manually porting in users you have to manage them after the fact...
My typical scenarios include using workspaces as only the authoring spaces for content. Then sharing the vast majority of that content via dashboards. The reason I do this, is I can use AAD security groups as recipients... So can be a large group of users in that group that is still managed by IT.
Apps at first glance also appear to be a better solution "eventually" -> they currently don't support AD Groups yet, but will in the future.
