Allowing users to create calculated views
You are right, you shouldn't allow people to change php code on your site. 

I would allow a lot of customization to the data that is returned via views filters. 

You can return the data in a table format and allow this table to be exported to excel or csv (there are views modules for both of these). Then people can create whatever they want. 

There are a few js libraries which can give you spreadsheet like functionality in the browser with an HTML table, that may be an option too.