If users are able to see reports when no reports have been assigned to that user, it is most likely because the "All reports are available for viewing" setting is activated. This setting, when enabled, makes it so that a user gets access to all reports by default. When access to one report is give, only then are that users access rights restricted.
