That's right. And the great thing about using SSAS roles is that it won't matter which vehicle your users are employing to view the data, they will only see data they have rights to see. Ie. It doesn't matter whether they are using Reporting Services, Excel Services, Excel, or PerformancePoint; each user will only see the data they are allowed to see.

A spin-off from this is that you can create one report (doesn't matter whether it is Reporting Services, Excel Services, Excel, PerformancePoint etc.) and when a users asks for that report, they will only see the data they have access to. For example, this means you can create one 'Weekly Sales Report' and each regional office that asks for exactly that report, will only get data for their region/office. And head office can ask for the same report and they will see sales for the entire organisation. This makes report creation/management much much simpler.