What roles shall I assign to the users?

Summary:

I want to set up two categories of users:

1. Users who will be able to create their own books using existing standard reports.
2. Users who will be able to build their own reports using the existing standard ones as a starting point, without being able to change these standard reports.

What roles shall I give them and how do I set up security for the standard reports?