As you've noted, this is a complex and would require a proper discovery and planning phase to sort out all the details. Here are a few thoughts on each stage of the process that you discussed. It looks like Luke has approached the problem in a similar way in the comments above.
User1 has a login to the site, and has access to user_1_report.pdf
This could potentially be handled by a Craft Entries or Users Relations field. You could let somebody relate a Report to the specific User who should be able to see it, or allow a User Profile to be related to several differnet Reports. In whichever case, you could limit who has visibility to the reports in the front-end by only displaying Reports to Users who have the right relationship to them.
User2 logs in and sends a request to User1 to view user_1_report.pdf
This will need to be handled with a plugin. I would approach the problem in two steps. The first part of the problem is an email notification problem, and the second part is an action that will required changing the relationship or permissions of who has access to something. Depending on how secure you need things to be, there may also be a validation component to ensure that only a User that has received an invite is able to accept that invite.
There are likely some Email plugins that could help get you started with the Email notification part of this. We have built similar authentication workflows using Sprout Email. For the particular approval action that you need, it's likely you'll need to approach that as a separate custom plugin that handles the specific action you need.
User1 receives a notification in their members area and can click Approve / Deny
This is mostly addressed in my previous comment. When you trigger the notification email, you can make sure that the notification email includes a link to help the user Approve/Deny the request. In my discussion above, those Approve or Deny actions would probably be links to controller actions that handle the behavior you need, or to a page on your site that then allows the user to trigger the right action.
User2 gains access to the user_1_report.pdf as a download link in their members area.
Once the approval workflow is sorted out, this will likely just be handled in the same way as the first scenario – via a Relations field or some permission and the standard Twig code needed to output that data. One option could be to have an "Approved Users" field on a Report Entry, and your custom action would trigger adding the invited user as a Relation to the Report that they were invited to.