Mhm ... I'll throw in a paid one: i-net Crystal-Clear 10. The reason I do this is simple: I think it fits your needs, but it's a one time investment if you're happy with what it offers. Its constantly being improved and the support is much better than of the most open source or free communities (that should be taken into account).
The product is entirely Java. It has a powerful ad-hoc reporting component that is made to be an easy-to-use thing for non-technical users. Your users won't have to know anything about reporting at all. They simply select the kind of report, the data et voila there is a report suiting the needs.
The reporting server has a great web GUI for ad hoc reporting (and much more), but you could also access a Java applet.
The end users will not need any training since the GUI is highly intuitive. All reports (depending on security settings) can be accessed via DAV our a report repository gui.
The server supports different security settings on a per user or per group basis.
Disclosure: Yap. I'm working for the company who built this.