I believe it is "Hide UI for creating or customizing reports". This gives them the ability to edit reports although I know it says it is for creating. To restrict even further with reports you would hide the "Personal settings link" and they would not even be able to make personal reports.
Also be sure to clear the checkmark on the tables that let them save common reports if that is enabled. What can happen is without doing that the user will be able to create reports but never edit them. Assuming you turned off the Hide UI part above.