We have three different sister companies within our salesforce org. Account and Contacts are readable for all users irrespective of Business units. However, I need to provide create and export report access to one of the Business unit. But the challenge is they shouldn't be able to download/create reports with the other Business unit's data. How can I achieve this ? Please suggest.
Sorry, but you cannot allow users to create and export reports, and also block users from exporting certain sets of records that they otherwise have access to.
If they have the permission, they can create reports, and those reports can include all data they can view, and they can export those reports.
If you block creating reports, then you can put some controls around this, but unless you block api access or enable api allowlist, they can easily dump data via the api, and they can always print off list views etc etc.
You could perhaps get very crafty and find a way to switch users between a no export profile that can view all records and a profile w the export permission that can only view their business units records, but there is a fair bit of complexity down this rabbit hole, and still has the holes above re api access, list views, etc.
One possible exception could be what you can do with event monitoring and transaction security policies. I don't know them in enough detail to say for sure, and they cost $$$. It looks like you can not get that granular to block that scenario, but you can trigger notifications for exports if you want to monitor for it.
See this for more details https://help.salesforce.com/articleView?id=sf.enhanced_transaction_security_policy_types.htm&type=5