How to let customers use their own reporting tools on a SaaS application?
Do not permit ad hoc querying against the operational database, no matter if it is internally generated or external. The potential to lock data or saturate resources is too large. Client B is not going to forgive the SLA breach caused by client A submitting a malformed query then going for lunch.

Separating each customer's data from the others' is important, too. Even if the data isn't "sensitive" it is not professional and can lead to awkward conversations when A realises their outcomes are so much worse than B's. The question doesn't make clear if the source is multi-tenant.

One solution is to replicate / mirror / copy data from the operational DB to a second, separate, isolated DB. Use whatever tool your product supports. This may be an opportunity to do some transformation if required and supported by the tool. The lag between primary and secondary is to be negotiated with the customer in the light of license, set-up and support costs. Grant read-only access on this secondary to the client. Ideally the primary and secondary would be on separate boxes with a firewall between since the latter will be externally accessible. Be kind to yourself on the SLA you agree for the secondary.

If the client can accept a reporting lag on the order of hours you could simply ftp the data to them on a schedule.

Is there a better option than VPNs? I'm not a networking expert, but I'd say that unless you have a specific problem with using a VPN, go with it.