Currently report_viewer(org) role controls access to Standard Reports, Custom Report and visibility of Analytics tab.
We cannot give our client access to only Standard Report or only Custom Reports.
I suggest following changes:
  • add standard_reports_viewer (org) role + "standard_reports_viewer" if "report_viewer" rule
  • add custom_reports_viewer (org) role + "custom_reports_viewer" if "report_viewer" rule
  • control visibility of Analytics tab only by visibility of at least one of its children, not by permissions.