I had the following experienced.

The customer wanted to disable "Excel Template" button on the Outlook ribbon when using the Dynamics 365 add-in for Outlook.

We succeeded to do that by editing the security roles in Dynamics but then we found out that "Run Report" option was turn off as well.
That is correct because both of the buttons “Run Report” and “Excel Template” internally work by Propagating some of the ExportToExcel Privilege permission to allow data to get exported.
So to disable “Excel Template” we have to disable "Document Template", "Personal Document Template", "Document Generation" and “Export to Excel”. "Export to Excel" is also part of "Run Report", so turn it off we are removing "Run Report" feature as well

Then the customer come back to us with the following statement:

1. Using the export icon in the report viewer, users can only export the displayed report to a file with exactly the data displayed.
2. When exporting via the Excel templates, however, before exporting, any other columns / data (including, for example, personal / internal data) that should not leave the company can be exported.
Accordingly, point 1 should definitely be allowed, but point 2 should not

From my point of view and customer experience he is aboslutly right and this shoudl not working as it working right now.

"Excel Template" and "Run Report", should have different options in security roles to disable each options indipendently from each other.