I believe all security info has to be in an LDAP. You can then use the parameters in ReportNet to filter the reports based on a security table in your database. For example, to pull the user that logged into ReportNet, you would use
#sq($account.personalInfo.userName)# in a calculation/filter, and then match that up with your security objects in the table and restrict the data that way. Of course, that's just one example, and there are probably better ways to utilize the security data.
Hope that helps.