Hi,
1) It's good that you don't assign SAP_ALL to dialog users. Generally, it's good to start from zero access/authorization and add required authorization/access. Assigning SAP_ALL is exact opposite of this approach. Even SAP provides a role for WF-BATCH. It used to have SAP_ALL.
2) Correct
Martin