Strictly speaking, there is not a way to restrict drill-down. The only thing that can actually be restricted is direct access to view the records (the actual list of records or the form).
ACLs control access to the underlying table data. List reports require the reporting user to satisfy ACLs on the target table to view records in the list. Users without sufficient permissions may see filtered list reports.
Reports that present aggregate data, such as pie or bar charts, do not require the user to satisfy target table ACLs to view the chart. These reports are not filtered due to security, though may be filtered with ACLs or before query business rules defined for the target table. ACLs are required to view the list of records when you click on a portion of a chart.
The way this works in practice is that a user can see the pie chart, bar chart, etc. They can even drill down into the 'Other' category to see a sub-section of the chart. If they ever click down far enough to actually display a list of records they will be restricted based on the ACLs in place for the rows in that table.
Please mark my response as correct if I've answered your question. Thanks!
