Salesforce: Restricting reporting access while retaining Account-level field visibility

Hi everyone,

I’m looking for some advice on a Salesforce security/architecture scenario. 

We have a group of Sales users whose Account access is granted through criteria-based sharing rules based on the entity/company they work for

. For example, users belonging to different country entities receive access to the corresponding Accounts. 

These users are also assigned to a Permission Set Group that grants Read access to a number of financial fields on the Account object

. 

The business requirement is to restrict these users from creating or modifying Reports, exporting Report data, and accessing restricted company-wide financial Reports and Dashboards.

At the same time, they must retain their existing visibility when working with an individual Account they have access to, including the relevant financial information, Invoices and Orders.

This leads to a question around the same financial fields being available through different Salesforce surfaces.

If a user has FLS Read access to these Account fields so that they can see them on the Account Record Page:

Is there any standard/native Salesforce mechanism to prevent those fields from being available in List Views, while still allowing them to be displayed on the Account Record Page?

And regarding Reports:

If the user is allowed to run a centrally provided Report, is there a standard way to prevent the financial fields from being exposed through that Report while keeping the user's existing Account-level visibility? 

We explored using Custom Report Types to exclude these financial fields from the layout. However, if an Inside Sales user runs a centrally provided Report built on a report type that does

include these fields (because Outside Sales and Management users share the reports and need them), Salesforce will render the data for the Inside Sales user too, as long as their FLS is active. Salesforce does not support dynamic column masking or role-based field filtering within a shared Report Type. 

Or is the standard Salesforce security model that FLS applies globally across all these surfaces, with Report/Dashboard folder access and export permissions providing the only standard restrictions?

I’m interested specifically in the standard Salesforce capabilities, or is this only possible per custom and if yes, how? LWCs? 

Thanks!