Hi,

I am pretty sure you cannot pass the user and password through link, it is not secure at all.

I think that they have to give access to special group made for this, and the report can be limited only to these people who can see the documents.
If not you can put the document in some ftp but obviously they are not fan of the idea the document to be shared so I see only to reorganize your report policy.
You can limit also the result of the reports applying some filtering depending who is generating the report so he may see only the files he has access.

Hopes that will work.