while I don't web program, in the console world (which is probably the same as the web world) CR doesn't know or care or implement security. If you access it, you must have the ability to see report.
How can you get around this? Have your parameters selected by the user in your web page (here you can apply security as to what they can see), pass them to a stored proc (again, you can pass the session variables as well and have the stored proc apply any security as needed as well) and set the dataset/datatable returned from the stored proc as the datasource of the report. As long as the data is in the format desired, CR will use it (ie you don't need to connect CR to a database if you don't want to)
HTH