service accounts.
you can have a dedicated service account for SSRS data connections, then give permission to the reports or report folders to Window Authentication groups.
The dedicated service account will be the one making the call to the database(s) in behalf of the Window Authentication groups.
Others can chime in on the approach they use, but this has worked out nicely for us working along with our Sys Admin.
Also remember people are allergic to change, whatever you do guide them dont berate them. Show them that there other possibilities without making them feel incompetent. soft skills, people skills go a long way.