How to return a dataset only if an unrelated username and password are correct?
Is it possible to combine these so that the first query will only return a result if the username and password had a match?


Yes, it's pretty simple; an EXISTS subquery (a semi-join):

-- query 1
select * 
from Reports
where exists
      ( select * from Users where username = @username and password = @password ) ;



  Would it be better as a cross join?


Not really. I suppose you mean something like that - with either from Reports cross join Users or from Reports, Users:

-- query 2
select r.* 
from Reports as r cross join Users as u 
where u.username = @username 
  and u.password = @password ;


While this would give you the same results, it would only if there is a UNIQUE constraint on Users (username). If there is no such constraint, you may have (however unlikely it may sound) 2 rows with same username and password and in that case get all results duplicated. The EXISTS subquery wouldn't have such a problem.
But my main preference for the exists approach is that it is much cleaner about its intentions (a semijoin, not a cross join). The FROM clause has the table that you intend to have in the result set. The cross join has both tables in the FROM clause and if the developer is not careful enough (i.e. to use SELECT r.* and not SELECT *, the user details will leak in the result. Only if you do want to include the user details in the result set, then yes, the cross join should be preferred.

I'd use aliases in all required places anyway and write the query like this. Note that queries 1 and 3 are identical, except for the use of aliases and formatting:

-- query 3
select r.* 
from Reports as r
where exists
      ( select * 
        from Users as u 
        where u.username = @username 
          and u.password = @password 
      ) ;