Hi Sean

It isn't a case of having roles or Audiences a site would usually have both.

Roles are for providing capabilities to perform a wide variety of actions in Totara are different contexts (site, category. course activity)

Audiences are for grouping users together for performing limited actions such as assigning learning

Limiting access to reports would usually be dome by roles with admin roles usually requiring access to reports across their group.

Regards