(sub reports/forms open before the main form)
If that means a sub report opens before the main report, I think you will find that it is true of forms but not reports.
Putting a password check on the form that opens the report won't stop anyone from opening the report from the nav pane if is visible there. We know that users should be prevented from being able to do that but I don't know if the OP does.
If I was to take the password approach I don't see why putting the password on the main report only wouldn't work in normal circumstances. Because the main report opens first, then you should be able to pass a value to OpenArgs of the subreport. If the sub is opened independently, it won't have open args property and should error. Trap the error and cancel the opening, same as for the main report.
EDIT - not sure if OpenArgs can be used without DoCmd.Openreport, which would be of no use. If not, a similar approach might work; not sure what that might be at present. Perhaps a custom report property.
The more we hear silence, the more we begin to think about our value in this universe.
Paraphrase of Professor Brian Cox.