First, I would never allow users to run their own queries on a production machine. They could run table scans or some other performance performer all day.
We have a similar situation, and we usually create custom stored procedures for users who "call" and only allow access to the backup server, which stores "almost live" data.
Our users are familiar with excel, so I create a stored procedure with sufficient parameters for filtering / tuning, and they can easily call it using something like:
EXEC YourProcedureName '01/01/2010','12/31/2010','Y',null,1234
I accurately document what the parameters do, and they usually go well from there.
To configure an excel request, you need to configure data sources on the user's PC (control panel - data sources - odbc), which will differ slightly depending on your version of windows.
In excel, you need to configure a βqueryβ, which is just the EXEC command on top. Depending on the version of Excel, it should be something like this: menu - data - import of external data - a new query to the database. Then select a data source, connect, skip the table chart creator and enter the above SQL. In addition, do not try to do one procedure, do everything, do different ones based on what they do.
As soon as the data is on the excel sheet, our users pull it onto other sheets and manipulate it as they see fit.
Some users are a little advanced and βtryβ to write their own SQL, but this is a pain. I end up debugging and fixing their wrong requests. In addition, as soon as you correct the request, they always mess with it and break it again. using a stored procedure means that they cannot change it, and I can put it in our other ways in the source code repository.