We wish to expose some of the application data (in MSSQL Server) to external users so that they can consume it in their OWN reporting environment.
Which would be the better options in terms of usability, ease of report creation, security or performance if the external users wish to do reporting in SSRS or Crystal reports:
If the only purpose for exposing this data is for reporting, then I would lean towards option #1, which would be exposing the data via secured views or SPs. The reason is because this would offer the best performance, because if you go through a WCF service that has to then hit the database, there's some performance overhead involved there as opposed to just going directly against the database.
This is assuming, of course, that your customers have the proper tools to access the database, such as SSRS or Crystal Reports, which it sounds like they do.
However, if you think that later on you might want other customers to consume this data in other ways (non-reporting ways), then a WCF service might be something to consider. It offers a lot of flexibility for external access to data without having to provide someone direct access to your database. For example, if someone doesn't have a reporting tool but you want to give them access to this data, if they can consume a WCF service then you're all set.
In summary, direct database access would probably provide the best performance, whereas WCF would probably provide greatest flexibility for access. So you should consider these factors and also keep the future in mind when making your decision.