Firstly, only reports that have been shared with or created by a user will be visible to them when opening from their interface. Unfortunately, if they have the direct link to a report not explicitly shared with them, then they can open it with "Edit Copy" permissions. There is no way to restrict that, but it's also pretty rare that they would be able to find non-shared workspaces without someone giving them a link.
"Approved" reports still don't automatically appear for all users, I really don't know what the approval actually does in the case of Workspaces. Unless you are talking about Projects in the "Company" folder... those will be visible... because in essence, they are shared with all users.
If you are really concerned about access, you could try the "Share with Anyone" option, and allow them to access only that report without requiring them to have an account.
Or you can pull the report as a PDF and send to them, or schedule a PDF to send to them at an appropriate granularity.