That's right. At the moment, the best way to secure the TMG Reporter site is using IIS. We have a knowledge base article on this here: http://support.fastvue.co/customer/portal/articles/166884-securing-the-tmg-reporter-website
However, role-based authentication tied into group reporting is a feature we have on the roadmap, due for delivery later this year.
Update - we now have a more comprehensive article about securing and publishing the TMG Reporter site: http://www.fastvue.co/blog/how-to-secure-and-publish-the-fastvue-tmg-reporter-web-site
It also shows you how to only allow administrator access to the 'Settings' tab in TMG Reporter. Very handy if you just want users to access reports and the dashboard without giving them the ability to make configuration changes.