Security rights - Updating TEST Company but not allow some rights

We've got someone in-house learning BOI.  I need to prevent him from doing any updates that will affect our LIVE company.  I can give him full rights to the TEST company, but I know there are some changes, like setup or adding UDFs, that you make in Sage that affect all companies.  THOSE are the areas I need to make sure he cannot modify.

I'm thinking if I don't give any rights to these modules below, we should be okay.  Thoughts? Suggestions?

LIBRARY MASTER

GENERAL LEDGER

CUSTOMER RELATIONSHIP MANAGEMENT

BANK RECONCILIATION

CUSTOM OFFICE

His goal is to have a process in place outside the system that allows us to order materials, receive them in, create sales order for a customer and invoice them -- without anyone manually doing these steps in Sage.  Thanks.