Wait. You have business users in your production system with SAP_ALL? If so, you have bigger problems than your PO release strategy. Step 1 - take away SAP_ALL and give them access to only the things they actually need. That will certainly require some work to build some new roles.
SAP security golden rule - nobody has SAP_ALL in production...
Steve.