Shane,
actually setting up a simple database security model isn't all that difficult. Steps are:
1. Secure Database tables so that only JDE system and DB admins have access. This should be done regardless of how your reporting solution accesses the data because its very easy for anyone to create a DSN or other DB connection and connect to your database from excel, msaccess, etc. If you are an Oracle shop I have a script I can share that would accomplish this task for you.
2. Create read-only DB View/Query objects that includes only the tables and fields you wish to give users access to. OK - this step can be a little time-consuming if you try to define a lot of views all at once ... I would just create these on a as needed basis when the report writers request them.
3. Grant Select/Read access to above DB Views to specific Roles as appropriate. e.g. Account Ledger (F0911) only accessible by Accounting role.
4. Create reporting User IDs. Either by specific user (more maintenance) or by role, e.g. Acctg, Sales, etc so you have reporting user ids that are used by multiple people in the same group / job function.
OK, maybe it takes more than a day or two to accomplish, and maybe the above is overly simplistic if you restrict access by Business Unit, but if you need to write/run some serious reports you'll find that ODA won't cut it and you'll need to do something like the above or purchase something like JDEDirect.
Good Luck,