Security - Best Design to Maintain User Profiles/Role Between HCM and FIN

We are implementing FIN – Expenses.  With this we will be syncing employees
person, job records from HCM along with their User Profile.

What is the best design/approach to maintain security on the
FIN side?

One design under consideration is:

• Sync all user profiles from HCM to Fin
• Use Dynamic Security on the Fin side to maintain
  – Expense Submitters and Expense Approvers.

Any feedback or things to consider as it relates to keeping user profiles and roles
in sync between HCM and FIN?  Issues with
terminations and/or inactivating user profiles?