Rather than just exposing SSRS instance itself, for security reasons you would typically do this using the ReportView control and some .Net application. Refer to this link for an explanation of how this is architected: Planning for Extranet or Internet Deployment