Our current deployment strategy is to build datasets/reports.

We assign end users with read/build permission to dataset and read permission on report. Some of these reports are published into Power BI apps.

Thus users can access the reports and build their own reports in their own workspaces.

Now we are trying out dataflows, and we wish to provide the power users with read access to the dataflows so that they can build their own models (but cannot see/change the dataflow SQL query). The only way to do this seems to be by giving the users viewer permision to the workspace. But this means they will be able to see all reports in the workspace. So does this mean I need to create a workspace specifically for this dataflow and give the users view permission to the workspace.