What about just using the Microsoft Query Wizard in Excel ?

It has a similar Query wizard to Access & Sql Server (its just an add-in in excel 2003 & below, included already in 2007). Users could select whatever data they wanted from tables and it will return it directly into Excel.

You could setup a datasource for the user to connect, so you can create a General 'Reports' user or such-like. This will allow you to Control Security through the SQL User account.

The user can potentially write SQL through the Query Wizard, and so could do Updates, but if you lock down the Users rights and only allow data reads it could work.