Workspace permissions

Users with viewer permission cannot download the report from Power BI service.

One must have min contributor access which would allow them to edit the reports as well.

One way can be for you to have an automation job that leverage the REST API to download the report and users having trigger access on that job thereby allowing them indirect access to downlaod the reports 

Hello Jajiro ,

the permissin above the viewer which is the contributer that allows users to Publish, Create, edit, and delete content, such as reports, in the workspace.

so you can't limit the restrictions if they're not viewers.

Hi Jajiro There is a way to block user from overwriting the Semantic model in the Tenant Settings. This setting however applies to the entire organization.