I'd recommend using Application Express (used to be called html_db) / Discoverer. Create the reports they need - and give them access to that. It's web based, you can tune the query and you can even schedule it to repopulate the cache on a daily or hourly basis etc. Might also want to look at using Oracle Portal too if you have multiple clients that you want to do it for. The less people with direct access to your database the better!