You should be able to simply grant "Browser" permission to "Everyone" for those objects (folders, reports, etc.) that you wish to be public. Don't change the SSRS virtual root properties in IIS. I don't think I have ever done this in production, but I have often done it on test servers when I didn't want to take time to set up security and I don't recall having any problems with it.