You create an account in Web Reporting for the user to access. It’s separate from the BES console, and separate from their network login. Completely different set of user accounts in there. (Although you
can
link them to a BES console user, to control what scope they can see.)