For users of <user - can't share> level permission, turn off their ability to modify / duplicate filters on sheets that have been shared to them.
The filters I give them with a sheet are the filters I want them to use, no other! The minute they see that they can duplicate / change filters our workflow is hosed.
You are on the right track with the permissions you allow on shared repors, i.e. - run only, no changes. Our "System Level" reports and sheets shared with users are sacroscant - we can't hold people accountable if they are working with reports and sheets with filters that they can change. 
