First, you are correct that you should not mark the "credit report" box unless the credit report contributed to the denial (in whole or in part).
The "outside source" box should also only be marked if applicable. This info must reflect upon the consumer’s credit worthiness, credit standing, capacity, character, general reputation, personal characteristics or mode of living [§615(b)]. Typically, this is info from an employer, landlord or other banks not reporting to the credit bureau.
It is absolutely fine to mark the "Credit report" box even though a credit report was pulled. By marking this box, you are telling the applicant there is something negative on their credit report. That way, they can dispute it if it isn't true. You are NOT disclosing you pulled a credit report.