Workspace: Seperate SharePoint site permissions from PBI workspace permissions?

I have a workspace in PBI and the associated SharePoint Online site.

I want to let people in the SPO site have rights to contribute, etc, etc... however, I do NOT want them to be able to see any of the reports, etc... in the PBI workspace of the same name.

I want to publish that workspace as an App and control access to it that way. 

My desire with the SPO workspace is to let a few users see stuff and use it as a UAT staging area and then when I publish the app it lets all the users of the site consume it as a "production copy".

Is there anyway to separate this or if someone has access to a SPO workspace site and I deploy a PBI report to it..they are always going to see it?

Thanks!