Hi,
as it was already mentioned SAP portal does not support expiry date on role assignments. All roles are assigned from today till they are manually removed from user/group. So if you need some control you have to build it outside of SAP portal. The best solution is that it allows automatic de-provisioning of roles after expiry day. We already mentioned pointing UME to ABAP/LDAP or implementing some kind of identity management solution. These solutions require some investment. So temporary you could implement a periodic manual process (e.g. weekly) that will remove roles that are not required anymore.
Cheers