OTBI custom folder security in production VS test environments

Summary

How are you managing your OTBI custom folder security from Production to Test when different?

Content

I our current environment we have several self service users that are creating report objects thru OTBI and are saving these objects in our DEV environment under a folder structure under shared/custom. We essentially worked with these self self service power users to create a folder structure that made sense to the business, set up security to allow them to create/update/delete reporting objects in these folders.  

This works great in dev, but we would like to limit this security in production as we would like user to only have read only in our Test and Prod environments.  We are currently using a 3 party tool to move all of these object from one environment to another which caries this security along.