You can restrict access to reports for your staff agents by creating a role that specifically removes access to reports. See article on roles and permissions.
By default, all staff agents will have access reports. You must manually create a role that restricts access.