Dataset is the same permissions for each user in the different workspaces. You can see this by looking at the manage permissions of the dataset. What I mean is that your reports from two different workspaces are linked to the same dataset.
So, if the user has build permisssion in workspace2, the user will get the build permission. But you can let the user as a viewer role in WS1, then the user won't be able to create a visual in WS1.