An alternative way of getting a Windows server is to set up an account for an Amazon EC2 or Azure server. There are free trial options available for small servers.

You could set up a login trigger on each node, which would prevent the reporting user from logging in if the node is not the read-only node. You can use sys.fn_hadr_is_primary_replica...