Do we have a reporting group where users can create and run reports, but not be able to publish to the Public Workspace?

There is a system group called "Personal Report Creator". This gives users permission to create and run reports, but they will not be able to publish reports to Public Workspace.

Einkauf