Hi Niels,
The option # 2 might not be appropriate as it doesn't get the role menus when you include profiles. So I still recommend option # 1, and while maintaining authorizations, the values can be validated with the AGR_1251 and AGR_1252 tables.
These two SAP Notes might be useful to address issues while importing the menus:
679050 - PFCG: Merging and combining authorizations
1486866 - PFCG: Error when merging composite role menus
Regards,
Raghu Boddu